59 lines
3.3 KiB
Markdown
59 lines
3.3 KiB
Markdown
# ADR-0014: Open Dependabot CRITICAL alerts block builds
|
|
|
|
**Status:** Accepted
|
|
**Category:** RELIABILITY
|
|
**Date decided:** Mid-project
|
|
**Date documented:** 2026-05-13
|
|
|
|
## Context
|
|
|
|
Every Meesho service ships its source dependencies as part of its container image. GitHub's Dependabot continuously scans those dependency manifests against the GitHub Advisory Database and surfaces alerts by severity. Without an enforcement teeth in the pipeline, CRITICAL CVEs can sit open for arbitrary time — merge gates can be bypassed (admin merges, hotfixes, repos that don't enforce branch protection), and a periodic audit only tells security org-wide rather than putting accountability on the team that's actively trying to ship.
|
|
|
|
## Decision
|
|
|
|
`deployArgoCD.groovy:dependabotCriticalCheck()` calls the GitHub Dependabot Alerts API for the repo on every build. If the API returns any open alert with severity `CRITICAL`, the pipeline aborts with `"Critical vulnerabilities found in repo: <name>. Please resolve the alerts marked with CRITICAL here and retry: <github dependabot URL>"`. There is no whitelist, no override flag, and no manual bypass available from the pipeline side.
|
|
|
|
## Alternatives Considered
|
|
|
|
N/A — organizational mandate. The Meesho security org required hard enforcement of the CRITICAL-CVE SLA on shipping code; the build-time gate is the implementation choice that satisfies it.
|
|
|
|
## Consequences
|
|
|
|
**Positive:**
|
|
- The deploying team is forced to act on the CVE (fix, escalate, or coordinate with the dependency owner) before they can ship — accountability lands on whoever is actively trying to push, not on a central security team.
|
|
- Confirmed firing in practice on real services (Farmiso-Backend, supplier_platform_insights, meesho-web-reels, supplier_platform_payouts as seen in #devops-tech) — the gate is not theoretical.
|
|
|
|
**Negative:**
|
|
- Engineers blocked by a CRITICAL alert mid-deploy have no in-pipeline bypass — even for hotfixes that are unrelated to the vulnerable dependency.
|
|
- The check depends on GitHub Dependabot's classification; a false-positive at CRITICAL would force a real outage detour.
|
|
|
|
**Neutral:**
|
|
- The check is per-build, not per-PR, so a recently-disclosed CVE can suddenly start blocking deploys for repos that have not changed.
|
|
|
|
## Constraints
|
|
|
|
- Meesho security org policy: open CRITICAL Dependabot alerts must be resolved before code is shipped. The build-time gate is the enforcement surface for that policy.
|
|
- Dependabot must remain enabled on every repo for the gate to be meaningful; that side of the policy lives in repo settings, not in this library.
|
|
|
|
## Current Assessment
|
|
|
|
- **Still appropriate** — the mandate stands and the gate is the correct enforcement point.
|
|
|
|
## Related Decisions
|
|
|
|
- [ADR-0006: Ringmaster as Mandatory Build Trigger Gate](0006-ringmaster-mandatory-build-trigger-gate.md) — another build-time hard gate; same architectural pattern of "fail closed at the pipeline boundary."
|
|
|
|
## Notes
|
|
|
|
- Key files: `src/com/meesho/stages/deployArgoCD.groovy`
|
|
- The check is unconditional — there is no whitelist of repos exempted from this gate.
|
|
- Discovery id: RELIABILITY-2
|
|
|
|
<!-- adr-generator-meta
|
|
discovery_id: RELIABILITY-2
|
|
run_id: 90b9a400-266c-4786-b793-d811efa99276
|
|
last_completed_at: 2026-05-13T12:23:00Z
|
|
mode: create
|
|
cache_uri: gs://ai-blitz-agent-readability/adr/devops-lib/adr-discovery.json
|
|
-->
|