Reachability jobs - #641
Draft
Nishnha wants to merge 3 commits into
Draft
Conversation
Adds a `dependabot reachability` subcommand and `infra.RunReachability` that runs the dependabot-reachability-cli as a Dependabot job: it starts the proxy and a reachability container (the reachability image playing the updater role), networks them so dependency fetches go through the proxy, trusts the proxy CA, and runs `reach run` over a pre-provided input set. Follows the update/graph command pattern; adds model.ReachabilityCommand and unit tests for the flag wiring. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a9cbd398-a2cf-426c-83a7-e42d5f9cf684
Bind-mounting the input dir fails when dependabot-cli itself runs inside a container (e.g. `act`, or a containerized runner), because the host daemon cannot resolve the runner-container path. Copy the input set into the container (chowned to dependabot) and copy the outputs back out, matching the updater's putCloneDir approach. Works under act and on real runners alike. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a9cbd398-a2cf-426c-83a7-e42d5f9cf684
…ugh) The reachability-cli should gather its own inputs rather than the Action staging them. reachRunCommand now adds `-repo <job source>` so `reach run` fetches the target's Dependabot alerts and dependency-graph SBOM itself, and reachAPIEnv surfaces a token (+ GHES API URL) into the container so those calls authenticate. In CI the calls egress through the proxy, whose github_api handler injects the github.com git_source credential for api.github.com - so providing that credential is enough and reach need not see the token. A caller that pre-stages alerts.json / sbom.json still wins: reach only fetches what is missing (the "run anywhere" property). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a9cbd398-a2cf-426c-83a7-e42d5f9cf684
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.