feat: improve CVE command, version-scan script, and per-branch statement guidance by amirbenun · Pull Request #4038 · elastic/cloudbeat

amirbenun · 2026-03-03T16:50:01Z

Add a script to scan go.mod dependency versions across main and all maintained branches and tags, and updates the CVE investigation guide with branch-per-minor versioning, a scan-classify-derive algorithm for affected and fix versions, and instructions to resolve CVE links via gh. This enables automated, consistent CVE statements and correct per-branch version reporting.

mergify · 2026-03-03T16:50:45Z

This pull request does not have a backport label. Could you fix it @amirbenun? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
backport-active-all is the label that automatically backports to all active branches.
backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

Copilot

Pull request overview

Adds automation and guidance to streamline Cloudbeat CVE investigations and generate consistent per-branch security statements, including a ref-scanning helper script and a GitHub Agentic Workflow to post statements to elastic/security issues.

Changes:

Added scripts/scan-go-mod-refs.sh to scan go.mod dependency versions across main, maintained minor branches, and tags.
Expanded llm/cve.md with per-branch versioning guidance and an investigation algorithm based on scanning refs and deriving affected/fix versions.
Introduced an agentic workflow definition to generate and post CVE security statements as issue comments in elastic/security.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File	Description
scripts/scan-go-mod-refs.sh	New scanning script to report dependency versions per ref (main/branches/tags).
llm/cve.md	Updated CVE investigation guide with per-branch versioning/derivation workflow and `gh`-based issue resolution.
.github/workflows/cve-statement-comment.md	Added Agentic Workflow to produce and post a CVE statement comment to `elastic/security`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-03T16:57:24Z

.github/workflows/cve-statement-comment.md

+
+Issue URL: **${{ github.event.inputs.issue_url }}**
+
+Parse owner, repo, and issue number from this URL. The comment goes to that issue in `elastic/security`.


The workflow text instructs to “Parse owner, repo, and issue number” from the input URL, but safe-outputs.add-comment.target-repo is hard-coded to elastic/security. Either validate that the URL’s owner/repo is elastic/security (and fail otherwise) or simplify the instructions to only parse the issue number to avoid ambiguity/mis-posting.

Suggested change

Parse owner, repo, and issue number from this URL. The comment goes to that issue in `elastic/security`.

Parse the issue number from this URL (the owner and repo are always `elastic/security`). The comment goes to that issue in `elastic/security`.

Copilot · 2026-03-03T16:57:24Z

scripts/scan-go-mod-refs.sh

+  echo "Fetching origin..." >&2
+  git fetch origin


--fetch runs git fetch origin, but the script relies on tags (git tag -l ...) and remote-tracking branches; git fetch origin does not guarantee all tags are present/up to date. This can silently miss releases and produce incomplete CVE version ranges. Consider fetching tags explicitly (e.g. include tags/pruning) or enumerating tags via git ls-remote --tags origin and then fetching the specific tag objects needed for git show.

Suggested change

echo "Fetching origin..." >&2

git fetch origin

echo "Fetching origin (including tags, pruning stale refs)..." >&2

git fetch --tags --prune origin

Copilot · 2026-03-03T16:57:24Z

scripts/scan-go-mod-refs.sh

+  while IFS= read -r tag; do
+    [[ -z "$tag" ]] && continue
+    REFS+=("$tag")
+  done < <(git tag -l "v${minor}.*" 2>/dev/null | sort -V || true)


git tag -l "v${minor}.*" reads local tags, but the goal (and docs) are to scan maintained versions on origin. If local tags are stale/missing, the scan output will be incorrect. Prefer listing tags from the remote (or ensuring tags are fetched) so the results reflect upstream state.

Suggested change

done < <(git tag -l "v${minor}.*" 2>/dev/null | sort -V || true)

done < <(git ls-remote --tags --refs origin "v${minor}.*" 2>/dev/null | awk '{print $2}' | sed 's|^refs/tags/||' | sort -V || true)

Copilot · 2026-03-03T16:57:25Z

scripts/scan-go-mod-refs.sh

+show_ref() {
+  local ref="$1"
+  local line
+  if line=$(git show "$ref":go.mod 2>/dev/null | grep -F "$LIBRARY_NAME"); then


grep -F "$LIBRARY_NAME" can match multiple lines (e.g., both require and replace, or indirect + direct) and will then embed newlines into line, producing multi-line output for a single ref. If the intent is a single module version per ref, tighten the match to the actual module column in go.mod (and/or select the first match explicitly) to avoid ambiguous results.

Suggested change

if line=$(git show "$ref":go.mod 2>/dev/null | grep -F "$LIBRARY_NAME"); then

if line=$(git show "$ref":go.mod 2>/dev/null | awk -v mod="$LIBRARY_NAME" '$1 == mod { print; exit }'); then

Copilot · 2026-03-03T16:57:25Z

scripts/scan-go-mod-refs.sh

+fi
+
+# Get maintained minor branches (e.g. 8.19, 9.2, 9.3)
+MINORS=$(curl -sL "https://elastic-release-api.s3.us-west-2.amazonaws.com/public/future-releases.json" | jq -r '.releases[].version' | sort -V | awk -F. '{key=$1"."$2; if(key!=p){if(p) print p; p=key}} END{if(p) print p}')


The maintained-minors pipeline uses curl -sL ... | jq ...; without curl -f (or equivalent) an HTTP error can yield confusing jq errors, and missing jq/curl will also fail without a clear message. Consider failing fast on HTTP errors and adding a small dependency check with a clearer stderr message so users know what to install/fix.

Copilot · 2026-03-03T16:57:25Z

llm/cve.md


 ## Output Format

+When **affected**, the statement (and optionally the YAML) should include **infected Cloudbeat version(s)** and **fix version(s)** (see [Cloudbeat version branches](#cloudbeat-version-branches-affected-infected-and-fix-versions)).


The link target #cloudbeat-version-branches-affected-infected-and-fix-versions does not match the actual heading text (### Cloudbeat version branches: affected and fix versions), so this anchor will be broken on GitHub. Update the fragment to match the heading’s generated anchor (e.g. #cloudbeat-version-branches-affected-and-fix-versions).

Suggested change

When **affected**, the statement (and optionally the YAML) should include **infected Cloudbeat version(s)** and **fix version(s)** (see [Cloudbeat version branches](#cloudbeat-version-branches-affected-infected-and-fix-versions)).

When **affected**, the statement (and optionally the YAML) should include **infected Cloudbeat version(s)** and **fix version(s)** (see [Cloudbeat version branches](#cloudbeat-version-branches-affected-and-fix-versions)).

Copilot · 2026-03-03T16:57:25Z

llm/cve.md

+
+**Algorithm (three steps)**
+
+1. **Scan** — Run the script. Use `-f` or `--fetch` to fetch `origin` first; otherwise it uses existing refs. It gets maintained minors from the future-releases API, then prints dependency version (or N/A) for `origin/main`, each maintained branch tip, and every tag `vX.Y.*`. It uses upstream refs only.


This section says the script scans origin branch tips and “every tag vX.Y.*” and “uses upstream refs only”, but scripts/scan-go-mod-refs.sh currently enumerates tags from the local repo (git tag -l) and --fetch doesn’t ensure tags are updated. Either adjust the script to truly use remote tags, or update this guidance so investigators don’t assume the output is complete without an explicit tag fetch.

Suggested change

1. **Scan** — Run the script. Use `-f` or `--fetch` to fetch `origin` first; otherwise it uses existing refs. It gets maintained minors from the future-releases API, then prints dependency version (or N/A) for `origin/main`, each maintained branch tip, and every tag `vX.Y.*`. It uses upstream refs only.

1. **Scan** — Run the script. Use `-f` or `--fetch` to fetch `origin` branch refs first; otherwise it uses existing local refs. It gets maintained minors from the future-releases API, then prints dependency version (or N/A) for `origin/main`, each maintained branch tip, and every **local** tag `vX.Y.*`. To ensure tags from `origin` are included, run `git fetch --tags` (or equivalent) before the script.

amirbenun added 5 commits February 22, 2026 12:25

trial

9d5f06b

scan script

aa2fe60

trim

c70b1ff

aw

7da40e3

Merge branch 'main' into gh-wf-cve

9199f10

Copilot AI review requested due to automatic review settings March 3, 2026 16:50

amirbenun requested a review from a team as a code owner March 3, 2026 16:50

Copilot started reviewing on behalf of amirbenun March 3, 2026 16:50 View session

mergify bot assigned amirbenun Mar 3, 2026

Copilot AI reviewed Mar 3, 2026

View reviewed changes

amirbenun added 2 commits March 3, 2026 20:49

shfmt

067a8d9

delete wf

cd01f92

amirbenun changed the title ~~feat: add CVE workflow, version-scan script, and per-branch statement guidance~~ feat: improve CVE command, version-scan script, and per-branch statement guidance Mar 4, 2026

olegsu approved these changes Mar 4, 2026

View reviewed changes

olegsu self-requested a review March 4, 2026 16:51

amirbenun merged commit 5cab6ec into elastic:main Mar 4, 2026
9 checks passed

amirbenun deleted the gh-wf-cve branch March 4, 2026 17:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: improve CVE command, version-scan script, and per-branch statement guidance#4038

feat: improve CVE command, version-scan script, and per-branch statement guidance#4038
amirbenun merged 7 commits intoelastic:mainfrom
amirbenun:gh-wf-cve

amirbenun commented Mar 3, 2026 •

edited

Loading

Uh oh!

mergify bot commented Mar 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Copilot AI Mar 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		Issue URL: ${{ github.event.inputs.issue_url }}

		Parse owner, repo, and issue number from this URL. The comment goes to that issue in `elastic/security`.

	Parse owner, repo, and issue number from this URL. The comment goes to that issue in `elastic/security`.
	Parse the issue number from this URL (the owner and repo are always `elastic/security`). The comment goes to that issue in `elastic/security`.

	done < <(git tag -l "v${minor}.*" 2>/dev/null \| sort -V \|\| true)
	done < <(git ls-remote --tags --refs origin "v${minor}.*" 2>/dev/null \| awk '{print $2}' \| sed 's\|^refs/tags/\|\|' \| sort -V \|\| true)

	if line=$(git show "$ref":go.mod 2>/dev/null \| grep -F "$LIBRARY_NAME"); then
	if line=$(git show "$ref":go.mod 2>/dev/null \| awk -v mod="$LIBRARY_NAME" '$1 == mod { print; exit }'); then


		## Output Format

		When affected, the statement (and optionally the YAML) should include infected Cloudbeat version(s) and fix version(s) (see [Cloudbeat version branches](#cloudbeat-version-branches-affected-infected-and-fix-versions)).


		Algorithm (three steps)

		1. Scan — Run the script. Use `-f` or `--fetch` to fetch `origin` first; otherwise it uses existing refs. It gets maintained minors from the future-releases API, then prints dependency version (or N/A) for `origin/main`, each maintained branch tip, and every tag `vX.Y.*`. It uses upstream refs only.

Conversation

amirbenun commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mergify bot commented Mar 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

amirbenun commented Mar 3, 2026 •

edited

Loading