Add corgea deps: inventory, verify (freshness/CVE), and install wrappers#89

Closed

Ibrahimrahhal wants to merge 29 commits into

mainfrom

cursor/dependency-freshness-check-89d1

Commits on May 25, 2026

Commits on May 26, 2026

Add opt-in CVE checks to corgea deps via vuln-api

juangaitanv
and
cursoragent
committed
Harden vuln-api client and fix CVE check report gaps
juangaitanv
committed
Apply cargo fmt and clippy auto-fixes across src/
juangaitanv
committed
Fix ci harness checks
juangaitanv
committed
Add strict clippy gate to check; fix run() failure detection
juangaitanv
committed
Add deps dogfood fixtures and offline integration tests.

juangaitanv
and
cursoragent
committed
Replace precheck with ecosystem install wrappers and simplify verification.

juangaitanv
and
cursoragent
committed
Add --fail-cve CI gate and stabilize deps CVE JSON output.

juangaitanv
and
cursoragent
committed
Expand --fail-cve test coverage for exit codes and JSON edge cases.

juangaitanv
and
cursoragent
committed
Add cargo-llvm-cov coverage command and CI floor gate.
juangaitanv
committed
Route GH Actions tests through ./harness ci.
juangaitanv
committed
Cover utils/api.rs auth helpers; ratchet floor to 41%.
juangaitanv
committed
Enrich --check-cve with fix version and advisory URL.
juangaitanv
committed
Fail loud on --check-cve without token and map vuln-api HTTP errors.

juangaitanv
and
cursoragent
committed
Surface [TOP-FIX] badge and 3-line CVE finding block in deps text output.
juangaitanv
committed
Document corgea deps --check-cve across agent skill, README, and clap help.

juangaitanv
and
cursoragent
committed
Parallelize CVE lookups with bounded concurrency and 429 retry.

juangaitanv
and
cursoragent
committed
Add GitHub Actions CVE recipe and dogfood workflow.

juangaitanv
and
cursoragent
committed
Include response body snippet in vuln-api error messages.
juangaitanv
committed
Extract vuln-api stub into a library + standalone binary.
juangaitanv
committed
Add --severity floor for corgea deps --fail-cve.
juangaitanv
committed
Fix dogfood workflow stub startup race in CI.

juangaitanv
and
cursoragent
committed

Commits on May 27, 2026

Add corgea deps inventory layer and nest freshness/CVE under deps verify.

juangaitanv
and
cursoragent
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add corgea deps: inventory, verify (freshness/CVE), and install wrappers#89

Add corgea deps: inventory, verify (freshness/CVE), and install wrappers#89
Ibrahimrahhal wants to merge 29 commits into
mainfrom
cursor/dependency-freshness-check-89d1

Commits on May 21, 2026

Add verify-deps command for supply-chain freshness checks

verify-deps: support pnpm-lock.yaml (v5, v6, v9)

verify-deps: add --fail-unpinned for unfrozen-dep CI gating

Add precheck wrapper for npm/yarn/pnpm/pip install commands

Commits on May 25, 2026

Add ./harness 5-script quality contract

Rename verify-deps subcommand to deps.

Commits on May 26, 2026

Add opt-in CVE checks to corgea deps via vuln-api

Harden vuln-api client and fix CVE check report gaps

Apply cargo fmt and clippy auto-fixes across src/

Fix ci harness checks

Add strict clippy gate to check; fix run() failure detection

Add deps dogfood fixtures and offline integration tests.

Replace precheck with ecosystem install wrappers and simplify verification.

Add --fail-cve CI gate and stabilize deps CVE JSON output.

Expand --fail-cve test coverage for exit codes and JSON edge cases.

Add cargo-llvm-cov coverage command and CI floor gate.

Route GH Actions tests through ./harness ci.

Cover utils/api.rs auth helpers; ratchet floor to 41%.

Enrich --check-cve with fix version and advisory URL.

Fail loud on --check-cve without token and map vuln-api HTTP errors.

Surface [TOP-FIX] badge and 3-line CVE finding block in deps text output.

Document corgea deps --check-cve across agent skill, README, and clap help.

Parallelize CVE lookups with bounded concurrency and 429 retry.

Add GitHub Actions CVE recipe and dogfood workflow.

Include response body snippet in vuln-api error messages.

Extract vuln-api stub into a library + standalone binary.

Add --severity floor for corgea deps --fail-cve.

Fix dogfood workflow stub startup race in CI.

Commits on May 27, 2026

Add corgea deps inventory layer and nest freshness/CVE under deps verify.