Skip to content

ci(alert-sync): adopt phenoShared reusable (-253 LOC) #513

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KooshaPari merged 1 commit into from
Apr 24, 2026
Merged

ci(alert-sync): adopt phenoShared reusable (-253 LOC) #513

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
262 changes: 4 additions & 258 deletions .github/workflows/alert-sync-issues.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,265 +1,11 @@
name: Alert Sync To Issues

name: Alert sync issues
on:
schedule:
- cron: '17 * * * *'
workflow_dispatch:

permissions:
actions: read
contents: read
issues: write
security-events: read

jobs:
sync:
runs-on: ubuntu-latest
steps:
- name: Sync CI/Dependabot/CodeQL Alerts To Issues
uses: actions/github-script@v7
with:
script: |
const owner = context.repo.owner;
const repo = context.repo.repo;

const AUTO_LABEL = 'auto-alert-sync';
const SOURCE_CI = 'source:ci';
const SOURCE_DEP = 'source:dependabot';
const SOURCE_CODEQL = 'source:codeql';

const FAILING = new Set(['failure', 'timed_out', 'action_required', 'startup_failure']);

const ensureLabel = async (name, color, description) => {
try {
await github.rest.issues.createLabel({ owner, repo, name, color, description });
} catch (error) {
if (error.status !== 422) throw error;
}
};

const normalizeSeverity = (value) => {
const raw = String(value || 'unknown').toLowerCase();
if (['critical', 'high', 'medium', 'low'].includes(raw)) return raw;
return 'unknown';
};

const keyMarker = (key) => `<!-- alert-sync-key: ${key} -->`;
const keyRegex = /<!-- alert-sync-key: ([^>]+) -->/;

const buildIssueMap = async () => {
const issues = await github.paginate(github.rest.issues.listForRepo, {
owner,
repo,
state: 'open',
labels: AUTO_LABEL,
per_page: 100,
});

const byKey = new Map();
for (const issue of issues) {
const body = issue.body || '';
const match = body.match(keyRegex);
if (match) byKey.set(match[1], issue);
}
return byKey;
};

const upsertIssue = async ({ key, title, body, labels }) => {
const existing = openIssuesByKey.get(key);
const mergedLabels = Array.from(new Set([AUTO_LABEL, ...labels]));

if (existing) {
await github.rest.issues.update({
owner,
repo,
issue_number: existing.number,
title,
body,
labels: mergedLabels,
state: 'open',
});
return;
}

await github.rest.issues.create({
owner,
repo,
title,
body,
labels: mergedLabels,
});
};

const closeIssueIfOpen = async (key, reason) => {
const existing = openIssuesByKey.get(key);
if (!existing) return;

await github.rest.issues.createComment({
owner,
repo,
issue_number: existing.number,
body: `Auto-closed by alert sync: ${reason}`,
});

await github.rest.issues.update({
owner,
repo,
issue_number: existing.number,
state: 'closed',
});
};

const safePaginate = async (fn, params) => {
try {
return await github.paginate(fn, params);
} catch (error) {
if ([403, 404, 410, 451].includes(error.status)) {
core.warning(`Skipping unavailable endpoint: ${error.message}`);
return [];
}
throw error;
}
};

await ensureLabel(AUTO_LABEL, '4b5563', 'Managed by alert sync workflow');
await ensureLabel(SOURCE_CI, '1d4ed8', 'Imported from GitHub Actions failures');
await ensureLabel(SOURCE_DEP, 'b45309', 'Imported from Dependabot alerts');
await ensureLabel(SOURCE_CODEQL, '7c3aed', 'Imported from code scanning alerts');
await ensureLabel('severity:critical', 'b91c1c', 'Critical severity finding');
await ensureLabel('severity:high', 'dc2626', 'High severity finding');
await ensureLabel('severity:medium', 'f59e0b', 'Medium severity finding');
await ensureLabel('severity:low', '84cc16', 'Low severity finding');
await ensureLabel('severity:unknown', '6b7280', 'Unknown severity finding');

const repoMeta = await github.rest.repos.get({ owner, repo });
const defaultBranch = repoMeta.data.default_branch;

const openIssuesByKey = await buildIssueMap();

const desiredCiKeys = new Set();
const desiredDepKeys = new Set();
const desiredCodeQlKeys = new Set();

const runs = await safePaginate(github.rest.actions.listWorkflowRunsForRepo, {
owner,
repo,
per_page: 100,
});

const latestByWorkflow = new Map();
for (const run of runs) {
if (run.event !== 'push') continue;
if (run.head_branch !== defaultBranch) continue;
if (run.status !== 'completed') continue;
const prev = latestByWorkflow.get(run.workflow_id);
if (!prev || new Date(run.created_at) > new Date(prev.created_at)) {
latestByWorkflow.set(run.workflow_id, run);
}
}

for (const run of latestByWorkflow.values()) {
const key = `ci:${run.workflow_id}:${defaultBranch}`;
if (FAILING.has(run.conclusion)) {
desiredCiKeys.add(key);
const title = `[CI] ${run.name} failing on ${defaultBranch}`;
const body = `${keyMarker(key)}\n\n` +
`- Workflow: ${run.name}\n` +
`- Branch: ${defaultBranch}\n` +
`- Conclusion: ${run.conclusion}\n` +
`- Run: ${run.html_url}\n` +
`- Commit: ${run.head_sha}`;
await upsertIssue({
key,
title,
body,
labels: [SOURCE_CI],
});
}
}

const dependabotAlerts = await safePaginate(github.rest.dependabot.listAlertsForRepo, {
owner,
repo,
state: 'open',
per_page: 100,
});

for (const alert of dependabotAlerts) {
const key = `dependabot:${alert.number}`;
desiredDepKeys.add(key);

const dependency = alert.dependency?.package?.name || 'unknown-dependency';
const ecosystem = alert.dependency?.package?.ecosystem || 'unknown';
const severity = normalizeSeverity(alert.security_advisory?.severity);
const manifestPath = alert.dependency?.manifest_path || 'unknown';

const title = `[Dependabot][${severity}] ${dependency}`;
const body = `${keyMarker(key)}\n\n` +
`- Dependency: ${dependency}\n` +
`- Ecosystem: ${ecosystem}\n` +
`- Severity: ${severity}\n` +
`- Manifest: ${manifestPath}\n` +
`- Alert: ${alert.html_url}`;

await upsertIssue({
key,
title,
body,
labels: [SOURCE_DEP, `severity:${severity}`],
});
}

const codeScanningAlerts = await safePaginate(github.rest.codeScanning.listAlertsForRepo, {
owner,
repo,
state: 'open',
per_page: 100,
});

for (const alert of codeScanningAlerts) {
const key = `codeql:${alert.number}`;
desiredCodeQlKeys.add(key);

const ruleId = alert.rule?.id || 'unknown-rule';
const ruleName = alert.rule?.name || ruleId;
const severity = normalizeSeverity(
alert.rule?.security_severity_level || alert.rule?.severity || 'unknown'
);

const title = `[CodeQL][${severity}] ${ruleName}`;
const body = `${keyMarker(key)}\n\n` +
`- Rule: ${ruleName} (${ruleId})\n` +
`- Severity: ${severity}\n` +
`- State: ${alert.state}\n` +
`- Tool: ${alert.tool?.name || 'unknown'}\n` +
`- Alert: ${alert.html_url}`;

await upsertIssue({
key,
title,
body,
labels: [SOURCE_CODEQL, `severity:${severity}`],
});
}

for (const [key] of openIssuesByKey.entries()) {
if (key.startsWith('ci:') && !desiredCiKeys.has(key)) {
await closeIssueIfOpen(key, 'latest default-branch workflow run is no longer failing');
}
if (key.startsWith('dependabot:') && !desiredDepKeys.has(key)) {
await closeIssueIfOpen(key, 'dependabot alert no longer open');
}
if (key.startsWith('codeql:') && !desiredCodeQlKeys.has(key)) {
await closeIssueIfOpen(key, 'code scanning alert no longer open');
}
}

core.summary
.addHeading('Alert sync completed')
.addTable([
[{ data: 'Type', header: true }, { data: 'Open alerts found', header: true }],
['CI failing workflows', String(desiredCiKeys.size)],
['Dependabot alerts', String(desiredDepKeys.size)],
['Code scanning alerts', String(desiredCodeQlKeys.size)],
])
.write();
uses: KooshaPari/phenoShared/.github/workflows/reusable/alert-sync-issues.yml@6a6e1b06026e9443449e419a2892cd0e47c19442
with:
auto-label: auto-alert-sync

@cursor cursor Bot Apr 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing permissions block for reusable workflow caller

High Severity

The alert-sync-issues.yml caller workflow no longer declares a permissions: block. This caps the reusable workflow's GITHUB_TOKEN scopes to the repository's default, potentially causing silent failures. The workflow needs issues: write, security-events: read, actions: read, and contents: read to create/update/close issues and read security alerts.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit af132b6. Configure here.

Loading