CI: real-tool smoke for osv-scanner, shellcheck and guarddog

.claude/skills/deep-code-review/scripts/review_checks.sh

@@ -792,7 +792,8 @@ if have trufflehog; then
   done
 elif [ -n "$files" ]; then add trufflehog "" 0 not-checked "not installed or heavy lease full; secrets were not scanned"; fi
 
-lock_files=$(changed '(^|/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|go\.sum|Cargo\.lock|poetry\.lock|requirements[^/]*\.txt|composer\.lock)$')
+# go.mod, not go.sum: osv-scanner 2.x reads Go deps from go.mod only (a go.sum errors, exit 127, and reads as not run)
+lock_files=$(changed '(^|/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|go\.mod|Cargo\.lock|poetry\.lock|requirements[^/]*\.txt|composer\.lock)$')
 [ -z "$lock_files" ] || wired+=" osv-scanner"
 # osvdb: REVIEW_OSV_DB_DIR, else (unless REVIEW_OSV=1 picked the online API) the provisioned osv-scanner cache once it holds a DB (provision_tools.sh --cache osv also honours an exported OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY). A cache without a DB is never used: osv-scanner then prints empty results, not an error, which would read as clean. Only this block reads it, so the registry-audit fallback below stays opt-in.
 osvdb=${REVIEW_OSV_DB_DIR:-} osvcold=

.github/workflows/ci.yml

@@ -515,8 +515,8 @@ jobs:
       - name: Allowlist guard
         run: REQUIRE_GITLEAKS=1 bash scripts/test_gitleaks_allowlist.sh
 
-  # The review_checks.sh stub tests never run a real scanner. This job installs the real tfsec, ansible-lint, rubocop, cfn-lint, pmd, solhint, hadolint, bandit, ruff, actionlint, zizmor, gosec, staticcheck, kube-linter, flawfinder, detect-secrets, gitleaks, trufflehog, checkov, kube-score, kubescape, semgrep, njsscan, tflint, kics, cppcheck, devskim, govulncheck, grype and trivy
-  # (pinned, hash-locked where the ecosystem allows; no advisory-DB download, except govulncheck, grype and trivy, which fetch their vulnerability DB online) and checks each is RAN with its rule id on one canary. bundler-audit and retire need a downloaded DB or rule set, so they stay stub-only; syft is an inventory the hub never counts as ran.
+  # The review_checks.sh stub tests never run a real scanner. This job installs the real tfsec, ansible-lint, rubocop, cfn-lint, pmd, solhint, hadolint, bandit, ruff, actionlint, zizmor, gosec, staticcheck, kube-linter, flawfinder, detect-secrets, gitleaks, trufflehog, checkov, kube-score, kubescape, semgrep, njsscan, tflint, kics, cppcheck, devskim, govulncheck, grype, trivy, osv-scanner, shellcheck and guarddog
+  # (pinned, hash-locked where the ecosystem allows; no advisory-DB download, except govulncheck, grype, trivy and osv-scanner, which fetch their vulnerability DB online: trivy by pinned digest, the rest live) and checks each is RAN with its rule id on one canary. bundler-audit and retire need a downloaded DB or rule set, so they stay stub-only; syft is an inventory the hub never counts as ran.
   real-hub:
     runs-on: ubuntu-24.04  # pinned: the cppcheck .deb below is the noble build and its runtime deps come from noble
     timeout-minutes: 25
@@ -732,6 +732,46 @@ jobs:
           grep -qF "repo=\"$dg\"" "$RUNNER_TEMP/dbdl.log"
           test -s "$RUNNER_TEMP/trivy-cache/db/trivy.db"
           echo "REVIEW_TRIVY_CACHE=$RUNNER_TEMP/trivy-cache" >> "$GITHUB_ENV"
+      - name: Install osv-scanner 2.7.1 (pinned sha256 from the release SHA256SUMS) and seed its offline DB
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/bin" "$RUNNER_TEMP/osv-seed"
+          cd "$RUNNER_TEMP"
+          curl --proto '=https' --tlsv1.2 --retry 3 --retry-delay 5 --retry-all-errors -fsSL -O https://github.com/google/osv-scanner/releases/download/v2.7.1/osv-scanner_SHA256SUMS
+          curl --proto '=https' --tlsv1.2 --retry 3 --retry-delay 5 --retry-all-errors -fsSL -O https://github.com/google/osv-scanner/releases/download/v2.7.1/osv-scanner_linux_amd64
+          test "$(grep -cF ' osv-scanner_linux_amd64' osv-scanner_SHA256SUMS)" = 1
+          grep -F ' osv-scanner_linux_amd64' osv-scanner_SHA256SUMS | sha256sum -c -
+          echo "fb7dab19a8bd9bbe5c3189f09d4b7ee1820c9553a23bac202648a56efd2f6ee8  osv-scanner_linux_amd64" | sha256sum -c -
+          install -m 0755 osv-scanner_linux_amd64 "$RUNNER_TEMP/bin/osv-scanner"
+          # the offline DB, pre-seeded the way the hub's own NOT CHECKED message says (the DB is the live OSV npm dump, not pinned); osv-scanner exits 1 when it finds vulnerabilities, so success is a non-empty zip
+          printf '{"name":"acme-seed","lockfileVersion":3,"requires":true,"packages":{"":{"name":"acme-seed","version":"1.0.0"},"node_modules/lodash":{"version":"4.17.15"}}}\n' > osv-seed/package-lock.json
+          # a go.mod too: the govulncheck canary's go.sum is also scanned by osv-scanner, and an ecosystem with no offline DB reads as not run
+          printf 'module example.com/acmeseed\n\ngo 1.22\n\nrequire golang.org/x/text v0.3.7\n' > osv-seed/go.mod
+          for i in 1 2 3; do
+            (cd osv-seed && OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY="$RUNNER_TEMP/osv-db" "$RUNNER_TEMP/bin/osv-scanner" --offline-vulnerabilities --download-offline-databases .) || true
+            # one verified zip per seeded ecosystem (npm, Go)
+            if zs=$(find "$RUNNER_TEMP/osv-db" -type f -name '*.zip' -size +0 2>/dev/null) && [ "$(printf '%s\n' "$zs" | grep -c .)" -ge 2 ] && printf '%s\n' "$zs" | while IFS= read -r z; do unzip -tq "$z" >/dev/null || exit 1; done; then break; fi
+            [ "$i" -lt 3 ] || { echo "osv-scanner offline DB download failed (need an npm and a Go zip)"; exit 1; }
+            sleep $((i * 10))
+          done
+          echo "REVIEW_OSV_DB_DIR=$RUNNER_TEMP/osv-db" >> "$GITHUB_ENV"
+      - name: Install shellcheck 0.11.0 (pinned sha256; the release publishes no checksums file, so the pin is the asset digest from the release API, re-verified against a fresh download)
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/bin"
+          cd "$RUNNER_TEMP"
+          curl --proto '=https' --tlsv1.2 --retry 3 --retry-delay 5 --retry-all-errors -fsSL -O https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.x86_64.tar.xz
+          echo "8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198  shellcheck-v0.11.0.linux.x86_64.tar.xz" | sha256sum -c -
+          tar -xJf shellcheck-v0.11.0.linux.x86_64.tar.xz --strip-components=1 -C "$RUNNER_TEMP/bin" shellcheck-v0.11.0/shellcheck
+          test "$("$RUNNER_TEMP/bin/shellcheck" --version | sed -n 's/^version: //p')" = 0.11.0
+      - name: Install guarddog 3.2.0 (hash-locked, own venv, so its boto3, cryptography, pygit2, pydantic and yara-python pins stay off the other venvs)
+        run: |
+          set -euo pipefail
+          python3 -m venv "$RUNNER_TEMP/venv-guarddog"
+          "$RUNNER_TEMP/venv-guarddog/bin/pip" install --quiet --retries 5 --require-hashes --only-binary=:all: -r scripts/real-hub-requirements-guarddog.txt
+          mkdir -p "$RUNNER_TEMP/bin"
+          ln -s "$RUNNER_TEMP/venv-guarddog/bin/guarddog" "$RUNNER_TEMP/bin/guarddog"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
       - name: Real-tool canaries
         run: REQUIRE_REAL_HUB=1 bash scripts/test-review-checks-real-hub.sh
 

changelog.d/hub-real-smoke-10.md

@@ -0,0 +1,2 @@
+### Changed
+- The real-hub CI job now also runs real osv-scanner 2.7.1, shellcheck 0.11.0 and guarddog 3.2.0 through `review_checks.sh` on fictional canaries, and fails unless each ran (no `not run`, no `NOT CHECKED`) and reported its rule on its canary file. osv-scanner reads the lockfile pinning lodash 4.17.15 and reports a `GHSA-*` advisory; shellcheck reports `SC2086` on an unquoted expansion; guarddog scans the one newly added lock package, installed under `node_modules` with a fictional mining-pool string, and reports `threat-process-cryptomining`, and the test also asserts the scan was full, not `guarddog(scanned-N-of-M)`. Pins: osv-scanner by sha256 from the release `SHA256SUMS` (also pinned literally); shellcheck by the release asset digest (the release publishes no checksums file), re-verified against a fresh download; guarddog hash-locked in its own venv (`scripts/real-hub-requirements-guarddog.txt`, since it pulls boto3, cryptography, pygit2, pydantic and yara-python). Fetches retry up to 3 times. osv-scanner's offline DB is pre-seeded with the command the hub's own NOT CHECKED message names and exported as `REVIEW_OSV_DB_DIR`; that DB is the live OSV npm dump, not pinned (the advisory assertion accepts any of five lodash 4.17.15 ids).