Fix/dependabot vulnerability alerts - #166
Closed
pthrasher wants to merge 7 commits into
Closed
Conversation
* fix: truncate oversized stack comments instead of failing the job When a single stack's rendered diff exceeds GitHub's 65536-character comment limit (e.g. a greenfield create of a very large stack where every resource is an addition), commentStack re-threw the "Body is too long" error, commentStacks collected it, and the whole action failed -- even though every other stack commented fine and the full diff is always present in the Action run logs. Make the per-stack path degrade gracefully: on a body-too-long error, post a truncated comment instead of throwing. The hash marker (used by findPrevious) sits at the start of the body so it always survives the cut; an open code fence is closed so the appended notice still renders; and the notice points the reader at the run logs for the full diff. The existing stage -> per-stack fallback in commentStages is unchanged -- truncation only kicks in when an individual stack still doesn't fit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Thrasher <thrasher@lumyx.com> * test: assert oversized stack comment is truncated, not failed Update the "stack comment fails too long" test to match the new behavior: a single stack whose comment exceeds GitHub's size limit is now posted truncated (a second updateComment with truncate: true) instead of failing the job. Resets the mock first since afterEach only mockClears (implementations leak between tests). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Thrasher <thrasher@lumyx.com> * chore: rebuild dist bundle + prettier-format test Apply the build's self-mutation patch manually: rebuild dist/index.js(.map) from the truncation fix and reformat the updated test. The repo's self-mutation job can't push this automatically (its PROJEN_GITHUB_TOKEN secret is unset), so it's committed by hand to keep dist in sync with src. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Thrasher <thrasher@lumyx.com> --------- Signed-off-by: Thrasher <thrasher@lumyx.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ing (#2) The oversized-comment handling shipped in v2.0.1 matched GitHub's validation error case-sensitively (`includes('Body is too long')`), but GitHub's actual per-stack create error is lowercase `body is too long (maximum is 65536 characters)`. The mismatch meant the truncation path never fired and the whole Workloads diff job failed when a single greenfield EKS stack's diff exceeded 65536 characters. Stop depending on GitHub's wording entirely. Comments now decides by assembled body length: - `Comments.buildBody` self-corrects: if the full body exceeds the limit, it replaces only the fenced ```shell diff block(s) with a pointer to the run logs, preserving all surrounding text (hash marker, headers, destructive-change warnings, commit footer). A diff is the only unbounded part of a comment, so it is the only thing dropped. A hard-cut remains as a last resort for the pathological no-diff-but-still-too-long case. - `Comments.fits` drives the stage->per-stack split proactively, so each stack's diff gets its own size budget before any diff is dropped. - The error-string matcher (`bodyTooLongError`), the catch/retry dance, and the `truncate` opt are removed -- buildBody always produces a body that fits, so posts no longer fail on size. Tests now reproduce production: the real Comments is exercised in comment.test.ts (oversized diff replaced, surrounding text kept, fits()), and stage-processor.test.ts drives the split via fits() instead of a faked rejected POST. Also point `autoApproveOptions.allowedUsernames` at pthrasher in .projenrc.ts so the generated auto-approve workflow stops reverting to the upstream owner on regeneration. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Added npm, docker, and GitHub Actions package ecosystems to Dependabot configuration.
Updated Dependabot configuration to schedule daily updates for npm and GitHub Actions dependencies, and added labels and groups for better organization.
Triage of every open alert (with per-package reachability analysis of the shipped ncc bundle) resulted in a fix for all of them: - undici 5.29.0 (EOL, 12 alerts incl. reachable decompression-chain DoS on the GitHub API path): bump @actions/core to ^2.0.3 and @actions/github to ^8.0.1, which move to undici ^6.23.0 -> 6.28.0. v3/v9 are ESM-only and break ncc's CJS bundling, so v2/v8 (CJS) are the ceiling for now. - fast-xml-parser / fast-xml-builder (14 alerts incl. 2 critical, parses every CloudFormation/STS XML response): npm overrides to ^5.7.1 / ^1.1.7 plus @aws-sdk tree refresh off the 3.808.0 pins. - minimatch (10 alerts): per-major overrides (3.1.5 / 5.1.8 / 9.0.7 / 10.2.3); @aws-cdk/cdk-assets-lib exact-pins 10.0.1 so only an override moves it. - picomatch (2 alerts): overrides scoped to micromatch/anymatch/jest-util so the picomatch@4 copy used for stack selection is untouched. - showdown (3 alerts, no patch exists): removed the vestigial, never-invoked action-docs devDependency that pulled it in. - In-range lockfile bumps: brace-expansion 1.1.18/2.1.4/5.0.9, js-yaml 3.15.1/4.3.1, yaml 1.10.3 (parses CloudFormation GetTemplate bodies on the diff path), fast-uri 3.1.5, lodash 4.18.1, glob 10.5.0/11.1.0, uuid 11.1.1, @babel/core 7.29.7, flatted 3.4.4, ajv 8.20.0. Supporting changes: tsconfig moduleResolution nodenext (octokit v7 types live behind package-exports subpaths), Context type derived from the main @actions/github export (./lib/context is no longer exported), jest transformIgnorePatterns whitelisting the ESM-only @octokit chain, and tests mock @actions/core via a jest.mock factory (swc's CJS interop exports are non-configurable, so jest.spyOn can no longer patch them). dist/ is rebuilt so the patched dependency tree actually ships to action consumers. Known residuals: projen's bundled js-yaml@4.1.1 (needs an upstream projen release) and dev-only uuid 8.x under jest-junit (no in-major patch; only v4() is ever called). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ar4YQFrftqZtHUzadQX1Mu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #