Merge remote-tracking branch 'origin/main' into linear/sou-1551-sourcebot-devsourcebot-cve-2026-59869-js-yaml-js-yaml-5e0b

# Conflicts:
#	CHANGELOG.md

Author: jsourcebot

.github/workflows/vulnerability-triage.yml

@@ -43,6 +43,31 @@ on:
         required: false
         type: boolean
         default: false
+      linear_assignee_id:
+        description: 'Linear user UUID to assign. Leave empty to use assign_to_api_key_owner behavior.'
+        required: false
+        type: string
+        default: ''
+      assign_to_api_key_owner:
+        description: 'Assign issues to the Linear API key owner when linear_assignee_id is empty.'
+        required: false
+        type: boolean
+        default: true
+      linear_state_name:
+        description: 'Linear workflow state for newly created or reopened issues.'
+        required: false
+        type: string
+        default: 'Triage'
+      linear_cycle_id:
+        description: 'Linear cycle UUID to assign. Takes precedence over linear_use_active_cycle.'
+        required: false
+        type: string
+        default: ''
+      linear_use_active_cycle:
+        description: 'Assign issues to the Linear team active cycle when linear_cycle_id is empty.'
+        required: false
+        type: boolean
+        default: false
     secrets:
       LINEAR_API_KEY:
         required: true
@@ -58,6 +83,7 @@ permissions:
   contents: read
   packages: read
   security-events: read # Required for CodeQL alerts API
+  vulnerability-alerts: read # Required for Dependabot alerts API
   id-token: write # Required for OIDC authentication
 
 jobs:
@@ -133,7 +159,7 @@ jobs:
         id: check
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT }}
+          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT || secrets.GITHUB_TOKEN }}
         run: |
           HAS_ALERTS=false
 
@@ -184,7 +210,7 @@ jobs:
       - name: Write alerts summary
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT }}
+          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT || secrets.GITHUB_TOKEN }}
         run: |
           echo "## Dependabot & CodeQL Alert Check" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
@@ -252,8 +278,6 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-        with:
-          submodules: recursive
 
       - name: Download scan results
         if: needs.scan.outputs.has_vulnerabilities == 'true'
@@ -279,7 +303,7 @@ jobs:
 
       - name: Fetch Dependabot alerts
         env:
-          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT }}
+          DEPENDABOT_PAT: ${{ secrets.DEPENDABOT_PAT || secrets.GITHUB_TOKEN }}
         run: |
           if [ -z "$DEPENDABOT_PAT" ]; then
             echo "::warning::DEPENDABOT_PAT not configured. Writing empty Dependabot alerts."
@@ -541,13 +565,17 @@ jobs:
           LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
           LINEAR_TEAM_ID: ${{ secrets.LINEAR_TEAM_ID }}
           REPOSITORY: ${{ github.repository }}
+          LINEAR_STATE_NAME: ${{ inputs.linear_state_name || 'Triage' }}
         run: |
           set -euo pipefail
-          # Resolve team UUID + the "CVE" label, "Triage" state, and API key owner once,
-          # and expose them as outputs so the issue-creation step can reuse them.
-          METADATA_QUERY='query($teamId: String!) { team(id: $teamId) { id labels(filter: { name: { eq: "CVE" } }) { nodes { id } } states(filter: { name: { eq: "Triage" } }) { nodes { id } } } viewer { id } }'
-          METADATA_PAYLOAD=$(jq -n --arg query "$METADATA_QUERY" --arg teamId "$LINEAR_TEAM_ID" \
-            '{query: $query, variables: {teamId: $teamId}}')
+          # Resolve team UUID, labels, configured state, active cycle, and API key
+          # owner once, then expose them for issue creation and reopening.
+          METADATA_QUERY='query($teamId: String!, $stateName: String!) { team(id: $teamId) { id labels(filter: { name: { eq: "CVE" } }) { nodes { id } } states(filter: { name: { eq: $stateName } }) { nodes { id } } activeCycle { id } } viewer { id } }'
+          METADATA_PAYLOAD=$(jq -n \
+            --arg query "$METADATA_QUERY" \
+            --arg teamId "$LINEAR_TEAM_ID" \
+            --arg stateName "$LINEAR_STATE_NAME" \
+            '{query: $query, variables: {teamId: $teamId, stateName: $stateName}}')
           METADATA_RESPONSE=$(curl -s -X POST https://api.linear.app/graphql \
             -H "Content-Type: application/json" \
             -H "Authorization: $LINEAR_API_KEY" \
@@ -556,6 +584,7 @@ jobs:
           TEAM_UUID=$(echo "$METADATA_RESPONSE" | jq -r '.data.team.id // empty')
           LABEL_ID=$(echo "$METADATA_RESPONSE" | jq -r '.data.team.labels.nodes[0].id // empty')
           STATE_ID=$(echo "$METADATA_RESPONSE" | jq -r '.data.team.states.nodes[0].id // empty')
+          ACTIVE_CYCLE_ID=$(echo "$METADATA_RESPONSE" | jq -r '.data.team.activeCycle.id // empty')
           VIEWER_ID=$(echo "$METADATA_RESPONSE" | jq -r '.data.viewer.id // empty')
 
           if [ -z "$TEAM_UUID" ]; then
@@ -594,6 +623,7 @@ jobs:
             echo "label_id=$LABEL_ID"
             echo "repo_label_id=$REPO_LABEL_ID"
             echo "state_id=$STATE_ID"
+            echo "active_cycle_id=$ACTIVE_CYCLE_ID"
             echo "viewer_id=$VIEWER_ID"
           } >> "$GITHUB_OUTPUT"
 
@@ -673,25 +703,42 @@ jobs:
           LABEL_ID: ${{ steps.match.outputs.label_id }}
           REPO_LABEL_ID: ${{ steps.match.outputs.repo_label_id }}
           STATE_ID: ${{ steps.match.outputs.state_id }}
+          ACTIVE_CYCLE_ID: ${{ steps.match.outputs.active_cycle_id }}
           VIEWER_ID: ${{ steps.match.outputs.viewer_id }}
+          CONFIGURED_ASSIGNEE_ID: ${{ inputs.linear_assignee_id }}
+          ASSIGN_TO_API_KEY_OWNER: ${{ inputs.assign_to_api_key_owner }}
+          LINEAR_STATE_NAME: ${{ inputs.linear_state_name || 'Triage' }}
+          CONFIGURED_CYCLE_ID: ${{ inputs.linear_cycle_id }}
+          USE_ACTIVE_CYCLE: ${{ inputs.linear_use_active_cycle }}
         run: |
           set -uo pipefail
-          # Team UUID, the "CVE" + repository labels, "Triage" state, and the API key
-          # owner's user ID were already resolved by the "Match existing Linear issues"
-          # step and passed in as env.
+          # Team UUID, labels, state, cycle, and assignee metadata were already
+          # resolved by the "Match existing Linear issues" step.
           STRUCTURED_OUTPUT=$(cat findings.json)
 
+          TARGET_ASSIGNEE_ID="$CONFIGURED_ASSIGNEE_ID"
+          if [ -z "$TARGET_ASSIGNEE_ID" ] && [ "$ASSIGN_TO_API_KEY_OWNER" = "true" ]; then
+            TARGET_ASSIGNEE_ID="$VIEWER_ID"
+          fi
+          TARGET_CYCLE_ID="$CONFIGURED_CYCLE_ID"
+          if [ -z "$TARGET_CYCLE_ID" ] && [ "$USE_ACTIVE_CYCLE" = "true" ]; then
+            TARGET_CYCLE_ID="$ACTIVE_CYCLE_ID"
+          fi
+
           if [ -z "$LABEL_ID" ]; then
             echo "::warning::Could not find 'CVE' label in Linear team. Creating issues without label."
           fi
           if [ -z "$REPO_LABEL_ID" ]; then
             echo "::warning::Could not resolve '$REPOSITORY' repository label. Creating issues without it."
           fi
           if [ -z "$STATE_ID" ]; then
-            echo "::warning::Could not find 'Triage' state in Linear team. Using default state."
+            echo "::warning::Could not find '$LINEAR_STATE_NAME' state in Linear team. Using default state."
+          fi
+          if [ -z "$TARGET_ASSIGNEE_ID" ]; then
+            echo "Issues will be created or reopened unassigned."
           fi
-          if [ -z "$VIEWER_ID" ]; then
-            echo "::warning::Could not resolve Linear API key owner. Issues will be created unassigned."
+          if [ "$USE_ACTIVE_CYCLE" = "true" ] && [ -z "$TARGET_CYCLE_ID" ]; then
+            echo "::warning::Could not resolve an active Linear cycle. Issues will be created without a cycle."
           fi
 
           # Map severity to Linear priority
@@ -716,7 +763,7 @@ jobs:
           # Write CVEs to temp file so the while loop doesn't run in a pipe subshell
           echo "$STRUCTURED_OUTPUT" | jq -c '.cves[]' > /tmp/cves.jsonl
 
-          MUTATION='mutation CreateIssue($teamId: String!, $title: String!, $description: String, $priority: Int, $labelIds: [String!], $stateId: String, $assigneeId: String) { issueCreate(input: { teamId: $teamId, title: $title, description: $description, priority: $priority, labelIds: $labelIds, stateId: $stateId, assigneeId: $assigneeId }) { success issue { id identifier url } } }'
+          MUTATION='mutation CreateIssue($teamId: String!, $title: String!, $description: String, $priority: Int, $labelIds: [String!], $stateId: String, $assigneeId: String, $cycleId: String) { issueCreate(input: { teamId: $teamId, title: $title, description: $description, priority: $priority, labelIds: $labelIds, stateId: $stateId, assigneeId: $assigneeId, cycleId: $cycleId }) { success issue { id identifier url } } }'
 
           while IFS= read -r cve; do
             CVE_ID=$(echo "$cve" | jq -r '.cveId')
@@ -737,22 +784,27 @@ jobs:
             fi
 
             if [ "$LINEAR_EXISTS" = "true" ] && [ "$LINEAR_CLOSED" = "true" ]; then
-              # Reopen the closed issue by setting its state back to Triage
+              # Reopen the closed issue using the configured repository routing.
               echo "Found closed Linear issue $LINEAR_IDENTIFIER for $CVE_ID ($LINEAR_URL) — will attempt to reopen"
               if [ -z "$STATE_ID" ]; then
-                echo "::warning::Cannot reopen $CVE_ID ($LINEAR_IDENTIFIER) — no Triage state found. Skipping."
-                echo "- Skipped **$CVE_ID** — found closed issue [$LINEAR_IDENTIFIER]($LINEAR_URL) but no Triage state to reopen" >> "$GITHUB_STEP_SUMMARY"
+                echo "::warning::Cannot reopen $CVE_ID ($LINEAR_IDENTIFIER) — no '$LINEAR_STATE_NAME' state found. Skipping."
+                echo "- Skipped **$CVE_ID** — found closed issue [$LINEAR_IDENTIFIER]($LINEAR_URL) but no '$LINEAR_STATE_NAME' state to reopen" >> "$GITHUB_STEP_SUMMARY"
                 SKIPPED_COUNT=$((SKIPPED_COUNT + 1))
                 continue
               fi
 
-              REOPEN_MUTATION='mutation($issueId: String!, $stateId: String!, $assigneeId: String) { issueUpdate(id: $issueId, input: { stateId: $stateId, assigneeId: $assigneeId }) { success issue { id identifier url } } }'
+              REOPEN_MUTATION='mutation($issueId: String!, $stateId: String!, $assigneeId: String, $cycleId: String) { issueUpdate(id: $issueId, input: { stateId: $stateId, assigneeId: $assigneeId, cycleId: $cycleId }) { success issue { id identifier url } } }'
               REOPEN_VARIABLES=$(jq -n \
                 --arg issueId "$LINEAR_ISSUE_ID" \
                 --arg stateId "$STATE_ID" \
                 '{issueId: $issueId, stateId: $stateId}')
-              if [ -n "$VIEWER_ID" ]; then
-                REOPEN_VARIABLES=$(echo "$REOPEN_VARIABLES" | jq --arg aid "$VIEWER_ID" '. + {assigneeId: $aid}')
+              if [ -n "$TARGET_ASSIGNEE_ID" ]; then
+                REOPEN_VARIABLES=$(echo "$REOPEN_VARIABLES" | jq --arg aid "$TARGET_ASSIGNEE_ID" '. + {assigneeId: $aid}')
+              else
+                REOPEN_VARIABLES=$(echo "$REOPEN_VARIABLES" | jq '. + {assigneeId: null}')
+              fi
+              if [ -n "$TARGET_CYCLE_ID" ]; then
+                REOPEN_VARIABLES=$(echo "$REOPEN_VARIABLES" | jq --arg cid "$TARGET_CYCLE_ID" '. + {cycleId: $cid}')
               fi
               REOPEN_PAYLOAD=$(jq -n --arg query "$REOPEN_MUTATION" --argjson vars "$REOPEN_VARIABLES" '{query: $query, variables: $vars}')
 
@@ -765,7 +817,7 @@ jobs:
               REOPEN_IDENTIFIER=$(echo "$REOPEN_RESPONSE" | jq -r '.data.issueUpdate.issue.identifier // empty')
               if [ -n "$REOPEN_URL" ]; then
                 echo "Reopened Linear issue $REOPEN_IDENTIFIER for $CVE_ID: $REOPEN_URL"
-                echo "- Reopened [$REOPEN_IDENTIFIER]($REOPEN_URL) for **$CVE_ID** — $TITLE (moved back to Triage)" >> "$GITHUB_STEP_SUMMARY"
+                echo "- Reopened [$REOPEN_IDENTIFIER]($REOPEN_URL) for **$CVE_ID** — $TITLE (moved to $LINEAR_STATE_NAME)" >> "$GITHUB_STEP_SUMMARY"
                 REOPENED_COUNT=$((REOPENED_COUNT + 1))
               else
                 echo "::error::Failed to reopen Linear issue $LINEAR_IDENTIFIER for $CVE_ID"
@@ -796,8 +848,13 @@ jobs:
             if [ -n "$STATE_ID" ]; then
               VARIABLES=$(echo "$VARIABLES" | jq --arg sid "$STATE_ID" '. + {stateId: $sid}')
             fi
-            if [ -n "$VIEWER_ID" ]; then
-              VARIABLES=$(echo "$VARIABLES" | jq --arg aid "$VIEWER_ID" '. + {assigneeId: $aid}')
+            if [ -n "$TARGET_ASSIGNEE_ID" ]; then
+              VARIABLES=$(echo "$VARIABLES" | jq --arg aid "$TARGET_ASSIGNEE_ID" '. + {assigneeId: $aid}')
+            else
+              VARIABLES=$(echo "$VARIABLES" | jq '. + {assigneeId: null}')
+            fi
+            if [ -n "$TARGET_CYCLE_ID" ]; then
+              VARIABLES=$(echo "$VARIABLES" | jq --arg cid "$TARGET_CYCLE_ID" '. + {cycleId: $cid}')
             fi
 
             PAYLOAD=$(jq -n --arg query "$MUTATION" --argjson vars "$VARIABLES" '{query: $query, variables: $vars}')
@@ -827,4 +884,4 @@ jobs:
           if [ "$FAILED_COUNT" -gt 0 ]; then
             echo "::error::Failed to create $FAILED_COUNT Linear issue(s)"
             exit 1
-          fi
+          fi

CHANGELOG.md

@@ -8,8 +8,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Fixed
+- Upgraded `tar` to `^7.5.20`. [#1474](https://github.com/sourcebot-dev/sourcebot/pull/1474)
+- [EE] Preserved cached repository permissions when OAuth token refresh fails because of a transient code host outage. [#1481](https://github.com/sourcebot-dev/sourcebot/pull/1481)
+- [EE] Classified code host permission sync failures by provider context before clearing cached repository permissions. [#1482](https://github.com/sourcebot-dev/sourcebot/pull/1482)
+- [EE] Added action-required warnings and guided recovery when permission syncing clears cached repository access. [#1484](https://github.com/sourcebot-dev/sourcebot/pull/1484)
+- Upgraded `brace-expansion` to `^1.1.16`/`^2.1.2`/`^5.0.7` to address CVE-2026-13149. [#1471](https://github.com/sourcebot-dev/sourcebot/pull/1471)
+- Upgraded `shell-quote` to `^1.10.0`. [#1469](https://github.com/sourcebot-dev/sourcebot/pull/1469)
 - Upgraded `js-yaml` to `^4.3.0`. [#1470](https://github.com/sourcebot-dev/sourcebot/pull/1470)
 
+### Changed
+- Reduced Sentry span sampling to 10% outside development. [#1475](https://github.com/sourcebot-dev/sourcebot/pull/1475)
+
 ## [5.1.3] - 2026-07-20
 
 ### Added