fix(security): route osv-scanner Maven resolution through Google Central mirror to end 429 flakes#346
Open
seonghobae wants to merge 2 commits into
Open
fix(security): route osv-scanner Maven resolution through Google Central mirror to end 429 flakes#346seonghobae wants to merge 2 commits into
seonghobae wants to merge 2 commits into
Conversation
Runner-queue starvation across the org: every doc-only, image-only, or empty re-trigger PR/push spawned a fresh ~120-min Strix scan, blocking all PR merges behind runner contention. Two security-preserving throughput fixes: 1. paths-ignore on push and pull_request_target for changes whose ENTIRE diff is non-executable documentation/image assets (*.md, *.rst, *.markdown, raster images, LICENSE, .github/ISSUE_TEMPLATE). A code security scanner has nothing to analyze in such a diff. Conservative: no source, no *.txt, no *.svg (can embed script), no CODEOWNERS, no build/workflow files. GitHub requires EVERY changed file to match, so any code/config/build/workflow change still scans. The weekly full-tree schedule (no path filter) backstops protected branches, and the merge scheduler still forces same-head evidence via workflow_dispatch (which paths-ignore does not affect) before merging managed PRs. 2. Cap the strix job at 60m (was 120m). The scan step is already hard-bounded to 30 min (timeout-minutes: 30 + STRIX_TOTAL_TIMEOUT=1800) and all other steps are quick/self-bounded; 120 only ever bit hung runs. 60m clears the realistic worst case with margin and is fail-closed. The head.sha concurrency / cancel-in-progress security design (which deliberately does NOT cancel in-progress scans on new commits) is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RjGVapDZ3k7V7zKYk16P4C
…ral mirror to end 429 flakes The required `osv-scan / osv-scan` gate intermittently failed APPROVED Maven PRs (clearfolio #76/#82/#83) with "No issues found" while osv-scanner resolved transitive parent POMs (spring-boot-starter-parent:3.5.0). It was a reliability failure, not a real vulnerability: repo.maven.apache.org returns HTTP 429 during transitive parent-POM resolution. osv-scanner resolves parent POMs over its own HTTP client (osv-scalibr pomxmlnet -> MavenRegistryAPIClient.defaultRegistry.URL), NOT via the `mvn` CLI or ~/.m2. It never reads ~/.m2/repository and parses settings.xml only for <servers> auth, not <mirrors> -- so caching ~/.m2 or a settings.xml mirror would be inert. The only effective lever is the `--maven-registry` flag, which sets that default registry URL. Fix: pass `--maven-registry=https://maven-central.storage-download.googleapis.com/maven2` (Google's byte-identical Maven Central mirror) via `scan-args`, keeping `-r ./` so recursion and transitive scanning stay fully enabled. No `--no-resolve`, no coverage reduction. Applied to both osv-scan callers (security-scan.yml HARD gate and osv-scanner-pr.yml analysis upload). Verified locally with osv-scanner 2.4.0 against a spring-boot-starter-parent:3.5.0 pom.xml: the default-central run reproduced the exact 429 on parent-POM resolution, the mirror run had zero 429s, and both resolved an identical set of 8 transitive packages (byte-identical POMs) -- confirming root cause and zero coverage loss. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RjGVapDZ3k7V7zKYk16P4C
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
The required `osv-scan / osv-scan` gate intermittently failed approved Maven PRs (clearfolio #76 / #82 / #83) with "No issues found" while osv-scanner resolved transitive parent POMs (`spring-boot-starter-parent:3.5.0`). It is a reliability failure, not a real vulnerability: `repo.maven.apache.org` returns HTTP 429 during transitive parent-POM resolution, which fails the reusable scan step and blocks the PR.
Why the obvious fixes don't work
osv-scanner resolves parent POMs over its own HTTP client (osv-scalibr `pomxmlnet` → `MavenRegistryAPIClient.defaultRegistry.URL`), not via the `mvn` CLI or `~/.m2`:
Fix
Pass `--maven-registry=https://maven-central.storage-download.googleapis.com/maven2\` (Google's byte-identical Maven Central mirror) via `scan-args`, keeping `-r ./` so recursion and transitive scanning stay fully enabled. No `--no-resolve`, no coverage reduction — only the default Central host is swapped for a rate-limit-friendlier mirror. Repos' own `pom.xml` `` are still added on top (scalibr `AddRegistry`).
Applied to both osv-scan callers: `security-scan.yml` (HARD gate, `fail-on-vuln: true`) and `osv-scanner-pr.yml` (analysis upload, `fail-on-vuln: false`).
Verification (osv-scanner 2.4.0, real `spring-boot-starter-parent:3.5.0` pom)
Confirms both the root cause and zero coverage loss. Mirror serves the same `maven2` layout and identical POM/metadata bytes (verified `200`, same content-length). YAML validated with `yaml.safe_load`.
🤖 Generated with Claude Code
https://claude.ai/code/session_01RjGVapDZ3k7V7zKYk16P4C