fix(github): Ignore vulnerability alerts in FIXED or DISMISSED states - #14431
Conversation
viceice
left a comment
There was a problem hiding this comment.
This will potentially break GHE and needs tests.
|
If it's too complicated to add GHE version detection to this, it would be better to undo this change and add the appropriate filtering on our client side instead, so it works with all. |
|
We already know if we on GHE, so check should be easy. We can enable filter on GHE when we know on which GHE version it's available later. |
|
But the problem this is addressing will still exist on GHE in the meantime? |
Indeed, I think it would be a bit complicated to check for the GHE versions that support of not the new But then, how would you filter on the client side? Because if we add the One option I thought about, but don't know if it's doable, is schema introspection, i.e. to check if the
From what I understand, yes. |
# Conflicts: # lib/modules/platform/github/__snapshots__/index.spec.ts.snap
This comment was marked as outdated.
This comment was marked as outdated.
|
Reopening this, as I changed my mind :) |
Head branch was pushed to by a user without write access
Head branch was pushed to by a user without write access
|
🎉 This PR is included in version 32.9.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
|
🎉 This issue has been resolved in version 32.76.3 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
Changes
When querying Github's GraphQL API to retrieve vulnerability alerts, only retrieve those that are in OPEN state.
Context
Closes #14316
The GraphQL request to retrieve vulnerabilities currently ignores their state (OPEN, FIXED or DISMISSED).
Fixed or dismissed vulnerabilities should not be considered as renovate will try to create PRs for these vulnerabilities, when actually the dependencies are already fixed (or the owner has decided they should not be fixed). This will also propose the PRs in the Dashboard issue under "Other branches" or "Ignored or blocked".
It seems this state was added recently, which may explain why this issue was not noticed before.
https://docs.github.com/en/graphql/reference/enums#repositoryvulnerabilityalertstate
https://docs.github.com/en/graphql/overview/changelog (Enum added on Feb 16th, 2022)
Documentation (please check one with an [x])
How I've tested my work (please tick one)
Note: I have not written any test for this as this is a feature of Github's GraphQL API. Let me know if I should still be writing a test for it.
I have verified these changes via: