Code drop of security group rotation email bot #2
Conversation
This implements a bot that emails the security group when new draft advisories show up in the llvm security group repo. This bot @s people who are currently oncall. To this end, it also introduces a yaml file (and supporting Python script) to define and extend the rotation. For running this, Github Actions presents a few challenges: 1. All bot runs are public - observable changes in logs/etc could disclose security issues prior to us publishing them. 2. This requires non-committed state (mostly "what advisories have been emailed about already?") So for now, the plan is just to run on one of my machines - I already run llvmbb-monitor with reasonable uptime; adding to that isn't hard. See https://github.com/gburgessiv/test-gha for development history (though it's entirely just me hacking on my own with no input ;) )
|
/cc @kbeyls @wphuhn-intel Given the size of this and intended runtime environment, I don't have a strong opinion on "we should do a full fine-toothed review" vs "it's going to be running on George's machine anyway, so shrug." I've tested it manually by having it email me using my access token, and all seems to work well (& the CI this PR adds passes, as well). In any case, happy to accept any/all comments, and land when those get resolved :) |
|
Thank you so much for implementing this @gburgessiv ! I guess that if we manually update the rota, you'll have to remember to update the checkout of the repo you have on your machine where this script will run? Maybe, after committing this and getting the script running, an email to the LLVM Security Response group with a copy of the current rota and some information about how to easily update the rota (do swaps) would be useful? |
|
Happy to help!
SGTM, I'll merge now and try to find time to set up the cronjob within the next few days.
Yeah, I figured that it's easiest if the rotation exists in editable form somewhere (b/c people will want to swap, or we'll discover that & yeah, the script will send reminder emails when the rotation runs low, but realistically it's probably 5 or so lines of bash to set up an every-month-or-so
Definitely can do. I'd ideally like to phrase instructions as "see this section of the README," so I may upload a follow-up PR adding notes along those lines. We'll see in the coming days :) |
This implements a bot that emails the security group when new draft advisories show up in the llvm security group repo. This bot
@s people who are currently oncall.To this end, it also introduces a yaml file (and supporting Python script) to define and extend the rotation.
For running this, Github Actions presents a few challenges:
So for now, the plan is just to run on one of my machines - I already run llvmbb-monitor with reasonable uptime; adding to that isn't hard.
See https://github.com/gburgessiv/test-gha for development history (though it's entirely just me hacking on my own with no input ;) )