security: OSV-Scanner on pull requests and weekly, a GitHub button, Fyne 2.8.2

.github/dependabot.yml

@@ -84,9 +84,18 @@ updates:
   # against immutable rule 11, which asks for a licence check on every one, and
   # against two gates that pin this graph on purpose. They are watched by a
   # scheduled job instead, which reports rather than proposes. O170.
+  #
+  # Grouped since 2026-10-14, when the file went from semgrep alone to every
+  # package it installs. Those move together - a semgrep release raises the
+  # floor of what it needs - and one pull request per package would leave
+  # each of them red against the others' old pins.
   - package-ecosystem: pip
     directory: "/.github"
     schedule:
       interval: weekly
     cooldown:
       default-days: 7
+    groups:
+      semgrep:
+        patterns:
+          - "*"

.github/requirements-semgrep.txt

@@ -20,6 +20,82 @@
 #
 # Licence read from the pinned version rather than recalled, on 2026-08-27:
 # LGPL-2.1-or-later, stated by the wheel metadata as a License-Expression and
-# carried in full beside it. It analyses the tree and is never linked into
-# either binary.
-semgrep==1.178.0
+# carried in full beside it. Read again for 1.180.0 on 2026-10-14, the same.
+# It analyses the tree and is never linked into either binary.
+#
+# Every package it installs is pinned below, not only semgrep, since
+# 2026-10-14. With the one line alone the vulnerability scanner has to guess
+# what pip would pick, and it guessed wrong: measured that day, a scan of
+# "semgrep==1.180.0" reported eleven advisories against python-multipart
+# 0.0.9, anyio 4.9.0 and idna 3.9.0, while pip on Python 3.14 installed
+# 0.0.32, 4.15.1 and 3.20, and a scan of what it really installed found
+# nothing. The list is `pip freeze` of a clean install on Linux with the
+# Python the job uses, which is the only place it is installed. Dependabot
+# reads every line, and carries them in one pull request - see the group in
+# dependabot.yml.
+annotated-types==0.8.0
+anyio==4.15.1
+attrs==26.1.0
+boltons==21.0.0
+bracex==3.1
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.5.2
+click==8.4.2
+click-option-group==0.5.9
+colorama==0.4.6
+cryptography==50.0.2
+exceptiongroup==1.2.2
+face==26.0.1
+glom==25.12.0
+googleapis-common-protos==1.75.5
+h11==0.16.0
+httpcore==1.0.9
+httpx==0.28.1
+httpx-sse==0.4.3
+idna==3.20
+importlib_metadata==8.7.1
+jsonschema==4.25.1
+jsonschema-specifications==2025.9.1
+markdown-it-py==4.2.0
+mcp==1.29.0
+mdurl==0.1.2
+opentelemetry-api==1.37.0
+opentelemetry-exporter-otlp-proto-common==1.37.0
+opentelemetry-exporter-otlp-proto-http==1.37.0
+opentelemetry-instrumentation==0.58b0
+opentelemetry-instrumentation-requests==0.58b0
+opentelemetry-instrumentation-threading==0.58b0
+opentelemetry-proto==1.37.0
+opentelemetry-sdk==1.37.0
+opentelemetry-semantic-conventions==0.58b0
+opentelemetry-util-http==0.58b0
+packaging==26.3
+peewee==3.19.0
+protobuf==6.33.6
+pycparser==3.11
+pydantic==2.14.1
+pydantic-settings==2.16.0
+pydantic_core==2.50.1
+Pygments==2.21.0
+PyJWT==2.15.1
+python-dotenv==1.2.4
+python-multipart==0.0.32
+referencing==0.37.0
+requests==2.34.2
+rich==15.0.0
+rpds-py==2026.9.1
+ruamel.yaml==0.19.1
+ruamel.yaml.clib==0.2.15
+semantic-version==2.10.0
+semgrep==1.180.0
+sse-starlette==3.5.0
+starlette==1.8.0
+tomli==2.4.1
+typing-inspection==0.4.4
+typing_extensions==4.16.0
+urllib3==2.8.0
+uvicorn==0.54.0
+wcmatch==8.5.2
+wrapt==1.17.3
+zipp==4.1.1

.github/scripts/dependency_gate.py

@@ -43,9 +43,10 @@
 # ABSENT on purpose. It is famously incompatible with GPL-3.0 and it is exactly
 # the kind of entry that looks fine in a list of open source licences and is not.
 #
-# Every identifier below except the last was measured in this repository's own
-# dependency graph on 2026-08-27, so the list describes what we actually have
-# rather than what somebody expected us to have.
+# Every identifier below except the last two was measured in this repository's
+# own dependency graph on 2026-08-27, so the list describes what we actually have
+# rather than what somebody expected us to have. The last two carry their own
+# reasons beside them.
 ALLOWED = frozenset({
     "0BSD", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "CC0-1.0", "ISC",
     "MIT", "MIT-0", "MPL-2.0", "Unlicense", "Zlib",
@@ -60,6 +61,17 @@
     # here. Without this entry three modules already in the tree would be
     # blocked the next time they moved.
     "LicenseRef-scancode-google-patent-license-golang",
+
+    # Fonts. GitHub reports fyne.io/fyne/v2 as "BSD-3-Clause AND OFL-1.1",
+    # measured on 2026-10-14 for both v2.8.1 and v2.8.2, because the toolkit
+    # carries Noto Sans and Inter Symbols in theme/font. Both are already
+    # compiled into the window and named in THIRD-PARTY-NOTICES.md with the
+    # full licence text, beside the Inter this project embeds itself. The OFL
+    # permits a font to be bundled with any software, and a font is data the
+    # program draws with rather than code linked into it, so it puts nothing
+    # on the GPL-3.0 code around it. Recorded here on the day the toolkit
+    # moved, which was the first time the gate saw it.
+    "OFL-1.1",
 })
 
 # Packages whose licence GitHub cannot resolve and which a person has already
@@ -94,11 +106,25 @@
 # refuses to let slide. That guard is what makes this skip honest.
 SKIPPED_ECOSYSTEMS = frozenset({"actions"})
 
+# Manifests of the tools CI installs, skipped for the same reason as the
+# actions above: what they list runs on a CI runner and is never in anything
+# this project ships.
+#
+# Named one file at a time rather than as the pip ecosystem, so a Python
+# dependency of anything shipped would still be asked. The semgrep requirements
+# went from one line to every package a clean install brings on 2026-10-14, so
+# that vulnerability scanners read what CI really installs, and that put 65 new
+# names in front of this gate - four of them with a licence GitHub leaves empty
+# or describes with an identifier of its own. Vulnerabilities in this file are
+# still checked, by the dependency review action and by OSV-Scanner.
+SKIPPED_MANIFESTS = frozenset({".github/requirements-semgrep.txt"})
+
 
 def added(review):
     return [d for d in review
             if str(d.get("change_type", "")) == "added"
-            and str(d.get("ecosystem", "")).lower() not in SKIPPED_ECOSYSTEMS]
+            and str(d.get("ecosystem", "")).lower() not in SKIPPED_ECOSYSTEMS
+            and str(d.get("manifest", "")) not in SKIPPED_MANIFESTS]
 
 
 def parts_of(expression):

.github/workflows/osv-pull-request.yml

@@ -0,0 +1,131 @@
+# Blocks a pull request that brings in a vulnerability the main branch does not
+# already have, by any package manifest in the tree - go.mod and the pinned
+# Python packages the semgrep job installs.
+#
+# The owner's decision of 2026-10-14: a pull request is stopped only for what it
+# adds. What main already carries is reported once a week to the Security tab by
+# osv-weekly.yml, and does not hold up a change that did not cause it.
+#
+# How it tells the two apart. The tree is scanned twice, first as the branch it
+# merges into and then as the merge itself, and the reporter compares the two
+# results - the method of the action's own pull request workflow. That workflow
+# is not called as it is, because it keeps the job token in the checkout to
+# switch branches and asks for security-events: write to upload. Neither is
+# needed: the base is the first parent of the merge commit, which a fetch depth
+# of two already holds, and a pull request has nothing to upload.
+#
+# Next to the two gates that already read the same go.mod. "review new
+# dependencies" looks only at what the diff adds and only through GitHub's
+# advisories. "known vulnerabilities" is govulncheck, which counts only what our
+# code can reach. This one reads OSV, which also covers the Python packages, and
+# counts a vulnerable package whether or not anything calls it - see
+# --no-call-analysis below.
+name: OSV pull request
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+# A push to the pull request makes the run before it pointless, and each run
+# scans the tree twice. The same grouping as dev-build.yml.
+concurrency:
+  group: osv-pull-request-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: new vulnerabilities (OSV)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          # The merge commit and its two parents, the first of which is the
+          # branch this pull request merges into.
+          fetch-depth: 2
+          persist-credentials: false
+
+      # Asserted rather than assumed, from the review of #181: with a commit
+      # of one parent here, HEAD^1 would be the pull request's own previous
+      # commit, and the comparison would find nothing new for the wrong reason.
+      - name: the branch this merges into
+        run: |
+          parents=$(git rev-list --parents -n 1 HEAD | wc -w)
+          if [ "$parents" -ne 3 ]; then
+            echo "::error::The checkout is not the merge commit of this pull request ($((parents - 1)) parent(s)), so there is no base to compare against."
+            exit 1
+          fi
+          git checkout --quiet --detach HEAD^1
+
+      # The scanner exits 1 when it finds something and with another code when
+      # it cannot scan at all, and the step cannot tell the two apart. The
+      # results file can, and the check further down reads it.
+      #
+      # --no-call-analysis=go because it cannot work here and fails loudly
+      # when tried. It compiles the tree, and this tree refuses to compile
+      # without the tags in .github/build-tags and a C compiler with the
+      # headers of the window's toolkit, neither of which the scanner's image
+      # carries. Measured 2026-10-14: hundreds of compile errors in the log, and
+      # every Go advisory reported as if called anyway. Whether a vulnerable
+      # function is reachable is what the govulncheck job answers.
+      - name: scan the branch this merges into
+        id: old
+        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --format=json
+            --output=osv-old.json
+            --no-call-analysis=go
+            --recursive
+            ./
+
+      - name: the merge of this pull request
+        env:
+          MERGE: ${{ github.sha }}
+        run: git checkout --quiet --force --detach "$MERGE"
+
+      - name: scan the merge of this pull request
+        id: new
+        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --format=json
+            --output=osv-new.json
+            --no-call-analysis=go
+            --recursive
+            ./
+
+      # Both files, whatever the scan steps returned. The reporter reads a file
+      # it cannot parse as one with no findings - measured 2026-10-14 on
+      # v2.6.0, from the review of #181: thirty findings cut short came out
+      # "No issues found", exit 0, and so did a missing file. Only a whole
+      # result goes on to be compared.
+      - name: both scans wrote a whole result
+        run: |
+          status=0
+          for f in osv-old.json osv-new.json; do
+            if ! jq -e '.results | type == "array"' "$f" > /dev/null 2>&1; then
+              echo "::error::$f is missing or is not a whole scan result, so the scan did not complete. Read the scan steps above for the cause."
+              status=1
+            fi
+          done
+          exit "$status"
+
+      # Fails the job on anything in the second scan that is not in the first.
+      # The log of this step is the list: every finding with its package, the
+      # advisory and the version that fixes it. The annotations on the pull
+      # request are not - measured 2026-10-14 with findings in two files, one
+      # annotation came out, for one of them.
+      - name: what this pull request adds
+        uses: google/osv-scanner-action/osv-reporter-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        with:
+          scan-args: |-
+            --old=osv-old.json
+            --new=osv-new.json
+            --output=osv-new.sarif
+            --gh-annotations=true
+            --fail-on-vuln=true

.github/workflows/osv-weekly.yml

@@ -0,0 +1,99 @@
+# Once a week, every known vulnerability in what the main branch depends on,
+# into the Security tab of the repository.
+#
+# The other half of osv-pull-request.yml. A pull request is stopped only for
+# what it adds, by the owner's decision of 2026-10-14, so a vulnerability that
+# was published against something main already uses has to show up somewhere
+# else - and that place is here. Weekly because an advisory is published on
+# its own schedule, not on ours: a tree nobody touches for a month still gets
+# new findings.
+#
+# The run is red while anything is found, and the results go up either way. A
+# clean upload is what closes the alerts of the week before, so an upload that
+# happened only on findings would leave fixed alerts open for ever. Red so that
+# a finding is also a failed run with a notice, rather than a line in a tab
+# somebody has to remember to open.
+#
+# The same scanner and the same arguments as the pull request workflow, so the
+# two cannot come to disagree about what counts. The reasons for each argument
+# are written there.
+name: OSV weekly
+
+on:
+  schedule:
+    # Monday 05:17 UTC, an hour after the weekly fuzzing in ci.yml.
+    - cron: "17 5 * * 1"
+  # By hand, from the Actions tab, after a fix is merged and before the next
+  # Monday - the alerts it closes close on the next upload.
+  workflow_dispatch:
+
+# A run by hand while the Monday one is going waits for it rather than
+# uploading beside it. Not cancelled: each run is a whole scan worth keeping.
+concurrency:
+  group: osv-weekly
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: vulnerabilities in main (OSV)
+    # By hand from another branch it would scan and upload that branch, and
+    # this workflow is about main. From the review of #181.
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      # The upload to the Security tab. Granted to this job only and to nothing
+      # a pull request runs.
+      security-events: write
+      # Read by the upload to name the run it belongs to - the action's own
+      # workflow grants it for the same step (github/codeql-action issue 2117).
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: scan
+        id: scan
+        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --format=json
+            --output=osv-results.json
+            --no-call-analysis=go
+            --recursive
+            ./
+
+      # Whatever the scan step returned. The reporter reads a file it cannot
+      # parse as one with no findings and writes a clean SARIF from it -
+      # measured 2026-10-14 on v2.6.0 - and a clean upload closes every alert.
+      - name: the scan wrote a whole result
+        run: |
+          if ! jq -e '.results | type == "array"' osv-results.json > /dev/null 2>&1; then
+            echo "::error::osv-results.json is missing or is not a whole scan result, so the scan did not complete and nothing is uploaded. Read the scan step above for the cause."
+            exit 1
+          fi
+
+      # Writes the results for the Security tab and fails the job when there
+      # is any, which is after the file is written - the upload below runs
+      # either way.
+      - name: results for the Security tab
+        uses: google/osv-scanner-action/osv-reporter-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        with:
+          scan-args: |-
+            --new=osv-results.json
+            --output=osv-results.sarif
+            --gh-annotations=false
+            --fail-on-vuln=true
+
+      - name: upload to the Security tab
+        if: ${{ !cancelled() && hashFiles('osv-results.sarif') != '' }}
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
+        with:
+          sarif_file: osv-results.sarif
+          category: osv-scanner