fix: only skip CVE remediation for open PRs

[brendan-kellam]

Summary

• resolve the current state of GitHub pull requests attached to Linear CVE issues
• suppress remediation only when at least one attached pull request is open
• keep issues with closed or merged pull requests eligible for a new remediation PR
• add workflow permissions and regression coverage for open and closed attachments

Test plan

• bash -n .github/scripts/find-unlinked-cve-issues.sh .github/scripts/test-cve-remediation.sh
• .github/scripts/test-cve-remediation.sh
• git diff --check

No changelog entry per request.

---

Note

Medium Risk
Changes which CVEs enter automated remediation and adds GitHub API calls in discovery; misclassification could duplicate or miss remediation PRs.

Overview
CVE discovery no longer treats any linked PR as “in progress.” Issues are excluded from nightly remediation only when a Linear attachment points at a GitHub pull request that is still open; CVEs linked only to closed PRs (or with no PR) stay eligible for a new remediation run.

The discovery script now resolves each unique linked PR URL via gh api (using GH_TOKEN) and attaches githubPrState before the jq filter runs. The reusable workflow’s discover job adds pull-requests: read and passes the workflow token into the script.

Tests and workflow copy were updated for open vs closed attachments and to assert GitHub state lookups and permissions.

^{Reviewed by Cursor Bugbot for commit 8b240a4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features

  • CVE remediation now identifies issues without an open linked pull request, including links to pull requests in companion repositories.
  • Pull-request states are validated before issues are filtered.

• Bug Fixes

  • Closed pull requests no longer incorrectly prevent CVE issues from being identified for remediation.

• Tests

  • Expanded coverage for open and closed pull requests, state validation, and workflow permissions.

[github-actions]

@brendan-kellam your pull request is missing a changelog!

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 95910976-d023-409f-acac-019c236da2f0

📥 Commits

Reviewing files that changed from the base of the PR and between 3ce4393 and 8b240a4.

📒 Files selected for processing (5)

• .github/scripts/filter-unlinked-cve-issues.jq
• .github/scripts/find-unlinked-cve-issues.sh
• .github/scripts/test-cve-remediation.sh
• .github/workflows/_cve-remediation.yml
• .github/workflows/cve-remediation.yml

---

Walkthrough

The CVE remediation workflow now queries linked GitHub pull-request states, enriches issue attachments with those states, and excludes only issues linked to open pull requests. Tests cover closed pull requests and companion repositories.

Changes

CVE open pull-request filtering

Layer / File(s)	Summary
Workflow permissions and authentication .github/workflows/_cve-remediation.yml, .github/workflows/cve-remediation.yml, .github/scripts/test-cve-remediation.sh	The discovery job requests pull-request read access and passes GH_TOKEN. Workflow descriptions and assertions refer to CVEs without open linked pull requests.
Pull-request state enrichment .github/scripts/find-unlinked-cve-issues.sh, .github/scripts/test-cve-remediation.sh	The discovery script queries each unique linked pull-request URL, validates open or closed states, and adds githubPrState to matching attachments. Tests mock gh api and verify endpoint queries.
Open-PR filtering and validation .github/scripts/filter-unlinked-cve-issues.jq, .github/scripts/test-cve-remediation.sh	The filter excludes issues only when a valid linked pull request has state open. Fixtures and expected results cover closed pull requests, including companion repositories.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CVEWorkflow
  participant DiscoveryScript
  participant GitHubAPI
  participant JQFilter
  CVEWorkflow->>DiscoveryScript: Pass GH_TOKEN and CVE issues
  DiscoveryScript->>GitHubAPI: Query each unique pull-request endpoint
  GitHubAPI-->>DiscoveryScript: Return open or closed state
  DiscoveryScript->>JQFilter: Pass enriched issue attachments
  JQFilter-->>CVEWorkflow: Return issues without open linked PRs

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch brendan/fix-cve-remediation-open-prs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8b240a4. Configure here.}

[cursor]

PR fetch failure aborts all discovery

Medium Severity

Any failed gh api lookup (or unparsable linked PR URL) exits the whole discovery script before filtering. One deleted, private companion, or temporarily unreachable attachment then blocks remediation for every CVE that night, including issues with no linked PRs. That conflicts with only suppressing issues that still have an open PR.

Additional Locations (1)

• .github/scripts/find-unlinked-cve-issues.sh#L107-L110

 

^{Reviewed by Cursor Bugbot for commit 8b240a4. Configure here.}