From b0b1c5c2246a64a6c2afacd5d01dd7d41c0a1b06 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 10 Jul 2026 18:24:00 +0900 Subject: [PATCH 1/5] Bound OSV scan fallback timeouts --- .github/workflows/security-scan.yml | 8 ++++++-- tests/test_required_workflow_queue_contract.py | 3 +++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 715550f34..6b7be8591 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -69,6 +69,7 @@ jobs: - name: Scan base with OSV id: osv_base continue-on-error: true + timeout-minutes: 8 uses: google/osv-scanner-action/osv-scanner-action@8dc09193bb540e09b23da07ad7e30bd33bf87018 # v2.3.8 with: scan-args: | @@ -81,10 +82,11 @@ jobs: - name: Explain base OSV resolver fallback if: steps.osv_base.outcome == 'failure' run: | - echo "::warning::OSV base scan failed before reporter output was trusted; retrying with --no-resolve to avoid transient transitive registry resolution failures such as Maven Central 429. Direct manifest and lockfile vulnerability evidence remains enforced." + echo "::warning::OSV base scan failed or timed out before reporter output was trusted; retrying with --no-resolve to avoid transient transitive registry resolution failures such as Maven Central 429. Direct manifest and lockfile vulnerability evidence remains enforced." - name: Retry base OSV without transitive resolution if: steps.osv_base.outcome == 'failure' continue-on-error: true + timeout-minutes: 4 uses: google/osv-scanner-action/osv-scanner-action@8dc09193bb540e09b23da07ad7e30bd33bf87018 # v2.3.8 with: scan-args: | @@ -105,6 +107,7 @@ jobs: - name: Scan head with OSV id: osv_head continue-on-error: true + timeout-minutes: 8 uses: google/osv-scanner-action/osv-scanner-action@8dc09193bb540e09b23da07ad7e30bd33bf87018 # v2.3.8 with: scan-args: | @@ -117,10 +120,11 @@ jobs: - name: Explain head OSV resolver fallback if: steps.osv_head.outcome == 'failure' run: | - echo "::warning::OSV head scan failed before reporter output was trusted; retrying with --no-resolve to avoid transient transitive registry resolution failures such as Maven Central 429. Direct manifest and lockfile vulnerability evidence remains enforced." + echo "::warning::OSV head scan failed or timed out before reporter output was trusted; retrying with --no-resolve to avoid transient transitive registry resolution failures such as Maven Central 429. Direct manifest and lockfile vulnerability evidence remains enforced." - name: Retry head OSV without transitive resolution if: steps.osv_head.outcome == 'failure' continue-on-error: true + timeout-minutes: 4 uses: google/osv-scanner-action/osv-scanner-action@8dc09193bb540e09b23da07ad7e30bd33bf87018 # v2.3.8 with: scan-args: | diff --git a/tests/test_required_workflow_queue_contract.py b/tests/test_required_workflow_queue_contract.py index ce5884b8c..bb9200868 100644 --- a/tests/test_required_workflow_queue_contract.py +++ b/tests/test_required_workflow_queue_contract.py @@ -118,8 +118,11 @@ def test_osv_scan_logs_and_retries_without_transitive_resolution_on_resolver_fai assert "steps.osv_head.outcome == 'failure'" in workflow assert "Retry base OSV without transitive resolution" in workflow assert "Retry head OSV without transitive resolution" in workflow + assert workflow.count("timeout-minutes: 8") == 2 + assert workflow.count("timeout-minutes: 4") == 2 assert workflow.count("\n --no-resolve\n") == 2 assert workflow.count("Maven Central 429") == 2 + assert workflow.count("failed or timed out before reporter output was trusted") == 2 assert "Direct manifest and lockfile vulnerability evidence remains enforced" in workflow assert "Retry base OSV without transitive resolution\n if: steps.osv_base.outcome == 'failure'\n continue-on-error: true" in workflow assert "Retry head OSV without transitive resolution\n if: steps.osv_head.outcome == 'failure'\n continue-on-error: true" in workflow From d2c6d719fa104976618dd96701797382746d5ea3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 10 Jul 2026 19:52:04 +0900 Subject: [PATCH 2/5] chore: refresh governed checks From 28a6bca2c25c1b515245040ec316b104ed092542 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 10 Jul 2026 19:54:46 +0900 Subject: [PATCH 3/5] chore: refresh last-push approval From a9c6c70e4720f59d1ee402084c370d9579514d0c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 10 Jul 2026 20:05:23 +0900 Subject: [PATCH 4/5] chore: refresh last-push approval From ccbe684c7f1c0af895752511b73ac0689f595f71 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 10 Jul 2026 20:38:53 +0900 Subject: [PATCH 5/5] chore: refresh last-push approval