Skip to content

security: Include branch name in security scan Slack alerts and fail only on high vulnerabilities #27977

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
harsh-vador merged 5 commits into from
May 11, 2026
Merged

security: Include branch name in security scan Slack alerts and fail only on high vulnerabilities #27977

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7b89506
Add branch context to security scan Slack alerts and upload CSV findi…
harsh-vador May 8, 2026
4bf3405
change failing severity from medium to high & address gitar
harsh-vador May 8, 2026
de20abf
fix csv formatting
harsh-vador May 8, 2026
3799b04
revert flattening changes
harsh-vador May 8, 2026
9d1f6f8
Merge branch 'main' into synk-branch-context
harsh-vador May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/security-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ jobs:
run: |
npx retire@5 \
--path node_modules/ \
--severity medium \
--severity high \
--outputformat json \
--outputpath retire-report.json

Expand Down Expand Up @@ -131,7 +131,7 @@ jobs:
channel-id: ${{ secrets.SLACK_CHANNEL_IDS }}
payload: |
{
"text": "🚨 Vulnerability scan failed, please check it <https://github.com/open-metadata/OpenMetadata/actions/runs/${{ github.run_id }}|here>. 🚨"
"text": "🚨 Vulnerability scan failed on branch `${{ github.ref_name }}`, please check it <https://github.com/open-metadata/OpenMetadata/actions/runs/${{ github.run_id }}|here>. 🚨"
}
env:
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
Expand All @@ -143,7 +143,7 @@ jobs:
channel-id: ${{ secrets.SLACK_CHANNEL_IDS }}
payload: |
{
"text": "🟢 Vulnerability scan passed for OpenMetadata Repo, please check it <https://github.com/open-metadata/OpenMetadata/actions/runs/${{ github.run_id }}|here>."
"text": "🟢 Vulnerability scan passed for OpenMetadata Repo on branch `${{ github.ref_name }}`, please check it <https://github.com/open-metadata/OpenMetadata/actions/runs/${{ github.run_id }}|here>."
}
env:
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
Expand Down Expand Up @@ -224,7 +224,7 @@ jobs:
channel-id: ${{ secrets.SLACK_CHANNEL_IDS }}
payload: |
{
"text": "🚨 Security report failed, please check it <https://github.com/open-metadata/OpenMetadata/actions/runs/${{ github.run_id }}|here>. 🚨"
"text": "🚨 Security report failed on branch `${{ github.ref_name }}`, please check it <https://github.com/open-metadata/OpenMetadata/actions/runs/${{ github.run_id }}|here>. 🚨"
}
env:
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
Expand All @@ -236,7 +236,7 @@ jobs:
channel-id: ${{ secrets.SLACK_CHANNEL_IDS }}
payload: |
{
"text": "🟢 Security report generated for OpenMetadata Repo , please check it <https://github.com/open-metadata/OpenMetadata/actions/runs/${{ github.run_id }}|here>."
"text": "🟢 Security report generated for OpenMetadata Repo on branch `${{ github.ref_name }}`, please check it <https://github.com/open-metadata/OpenMetadata/actions/runs/${{ github.run_id }}|here>."
}
env:
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
Expand Down
8 changes: 4 additions & 4 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ yarn_start_e2e_ui: ## Run the e2e tests locally in UI mode with Yarn
.PHONY: yarn_start_e2e_codegen
yarn_start_e2e_codegen: ## generate playwright code
cd openmetadata-ui/src/main/resources/ui && yarn playwright:codegen

.PHONY: py_antlr
py_antlr: ## Generate the Python code for parsing FQNs
antlr4 -Dlanguage=Python3 -o ingestion/src/metadata/generated/antlr ${PWD}/openmetadata-spec/src/main/antlr4/org/openmetadata/schema/*.g4
Expand Down Expand Up @@ -254,21 +254,21 @@ ui-checkstyle-core-components:
cd openmetadata-ui-core-components/src/main/resources/ui && yarn install --frozen-lockfile && yarn lint:fix && yarn pretty

# Fix linting and formatting errors in changed files in src folder
# Changed files are detected based on the current branch against main branch.
# Changed files are detected based on the current branch against main branch.
# So make sure to run this after rebasing to main to get the correct list of changed files.
.PHONY: ui-checkstyle-src-changed
ui-checkstyle-src-changed:
cd openmetadata-ui/src/main/resources/ui && yarn install --frozen-lockfile && yarn ui-checkstyle:changed

# Fix linting and formatting errors in changed playwright test files
# Changed files are detected based on the current branch against main branch.
# Changed files are detected based on the current branch against main branch.
# So make sure to run this after rebasing to main to get the correct list of changed files.
.PHONY: ui-checkstyle-playwright-changed
ui-checkstyle-playwright-changed:
cd openmetadata-ui/src/main/resources/ui && yarn install --frozen-lockfile && yarn ui-checkstyle:playwright:changed

# Fix linting and formatting errors in changed core components files
# Changed files are detected based on the current branch against main branch.
# Changed files are detected based on the current branch against main branch.
# So make sure to run this after rebasing to main to get the correct list of changed files.
.PHONY: ui-checkstyle-core-components-changed
ui-checkstyle-core-components-changed:
Expand Down
Loading