gate: add a credential-gated nancy scan #588

New issue

Open

opened 2026-09-22 17:11:11 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-22 17:11:11 +00:00

Owner

Context

nancy's OSS Index backend now requires credentials. An anonymous nancy sleuth
returns 401 Unauthorized. No credential exists in the default environment, and
fork CI cannot hold secrets. I keep nancy but gate it on credential presence.
Its marginal value is the proprietary OSS Index database. Without it, coverage
stays govulncheck plus osv-scanner.

What

Add a heavy-block step to scripts/gate.sh:

When OSSINDEX_USERNAME and OSSINDEX_TOKEN are set: run
go list -json -m all | nancy sleuth --no-color; a non-zero exit fails the
gate.
When they are unset: print a visible skip line, matching the gate's existing
"skipped is not a pass" convention for the conformance step. This is an
unavailable external prerequisite, not a suppressed failure.
Pin nancy in scripts/setup-dev.sh (record in the pin comment that upstream
is archived) and the ci.yml install step. Document the credential env vars as
secrets in the ci.yml header and docs/contributing/ci.md. Add the CLAUDE.md
line.

Acceptance

With no credentials: the gate prints the skip line, and its exit status is
unaffected.
With real credentials: the step runs, and a synthetically downgraded
dependency makes it fail. Prove this once, then revert.

## Context nancy's OSS Index backend now requires credentials. An anonymous `nancy sleuth` returns 401 Unauthorized. No credential exists in the default environment, and fork CI cannot hold secrets. I keep nancy but gate it on credential presence. Its marginal value is the proprietary OSS Index database. Without it, coverage stays govulncheck plus osv-scanner. ## What Add a heavy-block step to `scripts/gate.sh`: - When `OSSINDEX_USERNAME` and `OSSINDEX_TOKEN` are set: run `go list -json -m all | nancy sleuth --no-color`; a non-zero exit fails the gate. - When they are unset: print a visible skip line, matching the gate's existing "skipped is not a pass" convention for the conformance step. This is an unavailable external prerequisite, not a suppressed failure. - Pin nancy in `scripts/setup-dev.sh` (record in the pin comment that upstream is archived) and the ci.yml install step. Document the credential env vars as secrets in the ci.yml header and docs/contributing/ci.md. Add the CLAUDE.md line. ## Acceptance - With no credentials: the gate prints the skip line, and its exit status is unaffected. - With real credentials: the step runs, and a synthetically downgraded dependency makes it fail. Prove this once, then revert.

hexajon added the

security

testing

labels

2026-09-22 17:11:11 +00:00

hexajon referenced this issue

2026-10-13 22:23:04 +00:00

epic: code and supply-chain security hardening #759

hexajon added a new dependency

2026-10-13 22:23:14 +00:00

#759 epic: code and supply-chain security hardening