kevinveenbirkenbachandClaude Opus 5.5 090e3c115d fix(security): keep OSV downloads atomic, bound the issue sync and lint every suppression entry ...

CodeRabbit review of PR #1326:

- fetch_databases downloads each OSV archive to all.zip.part and replaces
  all.zip only after the transfer completes. An OSError removes the partial
  file and comes back as an `osv <ecosystem>: <error>` line instead of a
  traceback.
- run_gh bounds every gh call with a 120 s timeout. A failed or hung create,
  edit or close becomes a `failed <action>: <error>` line while the other
  issues and the close pass still run, and the command exits 1.
- The suppression lint checks every list item of a suppressions block, so an
  entry that starts with `until:` still needs its `# nocheck: cve <reason>`
  marker.

Part of #1324

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-01 12:45:24 +01:00

..

__init__.py

…

test_database.py

fix(security): keep OSV downloads atomic, bound the issue sync and lint every suppression entry

2026-11-01 12:45:24 +01:00

test_deploy.py

feat(ci): rotate the vulnerability engine per row and hand its databases over

2026-11-01 02:44:58 +01:00

test_engine.py

…

test_pipeline.py

…

test_suppressions.py

…