From f55391112644825e74782675e8ed7063a0df5c1a Mon Sep 17 00:00:00 2001 From: Melvin Carvalho Date: Sun, 18 Oct 2026 15:02:37 +0200 Subject: [PATCH] Advisory data: refresh by hand, remove the scheduled workflow The weekly workflow needs the repo setting that lets GitHub Actions open pull requests, which is staying off for now. Remove it and document the manual refresh. Data re-checked today: unchanged (722 advisories). --- .github/workflows/advisories.yml | 57 -------------------------- docs/security/known-vulnerabilities.md | 2 +- scripts/README.md | 14 +++---- src/components/AdvisoryTimeline.tsx | 2 +- 4 files changed, 8 insertions(+), 67 deletions(-) delete mode 100644 .github/workflows/advisories.yml diff --git a/.github/workflows/advisories.yml b/.github/workflows/advisories.yml deleted file mode 100644 index ae6b4f3..0000000 --- a/.github/workflows/advisories.yml +++ /dev/null @@ -1,57 +0,0 @@ -name: Refresh security advisories - -# Weekly refresh of static/data/openclaw-advisories.json, the data behind the -# chart and table on /security/known-vulnerabilities. Fetches OpenClaw's -# published GitHub security advisories (public data) with GITHUB_TOKEN and, -# if the file changed, opens or updates a pull request. See scripts/README.md. - -on: - schedule: - - cron: '23 5 * * 1' - workflow_dispatch: - -permissions: - contents: write - pull-requests: write - -concurrency: - group: advisories - cancel-in-progress: false - -jobs: - refresh: - runs-on: ubuntu-latest - timeout-minutes: 10 - steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v6 - with: - node-version: 24 - - name: Fetch advisories - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - node scripts/advisories.mjs --json static/data/openclaw-advisories.json > advisories-summary.md - cat advisories-summary.md >> "$GITHUB_STEP_SUMMARY" - rm advisories-summary.md - - name: Ignore a timestamp-only change - # generatedAt changes on every run; only open a PR when an advisory - # was added, removed or edited. - run: | - if git diff --quiet -I '"generatedAt"' -- static/data/openclaw-advisories.json; then - git checkout -- static/data/openclaw-advisories.json - echo "No advisory changes." - fi - - uses: peter-evans/create-pull-request@v8 - with: - branch: bot/advisories-refresh - delete-branch: true - add-paths: static/data/openclaw-advisories.json - commit-message: Refresh OpenClaw security advisory data - title: Refresh OpenClaw security advisory data - body: | - Weekly refresh of `static/data/openclaw-advisories.json` from the - GitHub security advisories API (`scripts/advisories.mjs --json`). - Check the new advisories, and update the prose on - `docs/security/known-vulnerabilities.md` (batches, latest release - passed to ``) if they need it. diff --git a/docs/security/known-vulnerabilities.md b/docs/security/known-vulnerabilities.md index c5c1d7e..672d69a 100644 --- a/docs/security/known-vulnerabilities.md +++ b/docs/security/known-vulnerabilities.md @@ -11,7 +11,7 @@ import {AdvisoryGenerated, AdvisoryChart, AdvisoryTable, MinimumSafeVersion} fro # Known Vulnerabilities -A readable record of OpenClaw's published security advisories and the major incidents around it. The advisory chart and table are generated from GitHub's [security advisories API](https://github.com/openclaw/openclaw/security/advisories) by `node scripts/advisories.mjs --json static/data/openclaw-advisories.json` in this site's repository, and a weekly workflow opens a pull request when the data changes. The prose sections below were last checked on 2026-10-18. +A readable record of OpenClaw's published security advisories and the major incidents around it. The advisory chart and table are generated from GitHub's [security advisories API](https://github.com/openclaw/openclaw/security/advisories) by `node scripts/advisories.mjs --json static/data/openclaw-advisories.json` in this site's repository; the data is refreshed by hand (last on 2026-10-18). The prose sections below were last checked on 2026-10-18. :::danger[Minimum safe version: the latest stable release] As of 2026-10-18 the latest stable release is **v2026.10.4** (published 2026-10-16). Always run the latest stable release, and update plugins with it: diff --git a/scripts/README.md b/scripts/README.md index 400f0bb..33fe9bd 100644 --- a/scripts/README.md +++ b/scripts/README.md @@ -100,14 +100,12 @@ node scripts/advisories.mjs --json static/data/openclaw-advisories.json node scripts/advisories.mjs --file adv.jsonl --json static/data/openclaw-advisories.json ``` -`.github/workflows/advisories.yml` runs this every Monday (and on manual -dispatch) with the workflow's `GITHUB_TOKEN`. If any advisory changed (a -`generatedAt`-only change is ignored), it opens or updates a PR from -`bot/advisories-refresh` via `peter-evans/create-pull-request`. When merging, -check whether the page's prose (batch sections, the latest release passed to -``) needs updating too. PRs opened with -`GITHUB_TOKEN` don't trigger other workflows; re-run the snippet check by hand -or push a commit to the branch if needed. +Refreshing is manual for now: run the command above, and if the JSON changed +(not just `generatedAt`), open a PR with it. When merging, check whether the +page's prose (batch sections, the latest release passed to +``) needs updating too. A scheduled workflow +that opens the PR automatically was removed until the repo allows GitHub +Actions to create pull requests. ## Tutorial tests (`tutorial-tests/`) diff --git a/src/components/AdvisoryTimeline.tsx b/src/components/AdvisoryTimeline.tsx index 7786e04..9b0a218 100644 --- a/src/components/AdvisoryTimeline.tsx +++ b/src/components/AdvisoryTimeline.tsx @@ -2,7 +2,7 @@ // // Data: static/data/openclaw-advisories.json, written by // `node scripts/advisories.mjs --json static/data/openclaw-advisories.json` -// and refreshed weekly by .github/workflows/advisories.yml. The JSON is +// and refreshed by hand (see scripts/README.md). The JSON is // imported (not fetched) so the chart and table are in the static HTML. // No window access at module scope; everything renders in SSR.