[hassaansaleem28]

Proposed change

Resolves #5321

Sync feature/o11y with main

Checklist

• Required: I followed the contributing workflow
• Required: I verified that my code works as intended and resolves the issue as described
• Required: I ran all required checks and tests locally; all warnings addressed and failures resolved
• I used AI for code, documentation, tests, or communication related to this PR

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 223 files, which is 123 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

• Source mode: Auto
• Repository: OWASP/Nest
• Branch: feature/o11y
• File: .coderabbit.yaml
• Commit: 2800bf8
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 06a5a5bd-2212-48f7-bc33-2623f8dc9829

📥 Commits

Reviewing files that changed from the base of the PR and between 2800bf8 and eeaf136.

⛔ Files ignored due to path filters: 6

• backend/poetry.lock is excluded by !**/*.lock
• cspell/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• docs/poetry.lock is excluded by !**/*.lock
• e2e/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• frontend/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 223

• .docksec-ignore.yml
• .github/actionlint.yaml
• .github/actions/install-infrastructure-dependencies/action.yaml
• .github/dependabot.yml
• .github/pr-labeler.yml
• .github/workflows/check-contribution.yaml
• .github/workflows/ci-cd-production.yaml
• .github/workflows/ci-cd-staging.yaml
• .github/workflows/ci.yaml
• .github/workflows/cluster-fuzz-lite.yaml
• .github/workflows/code-ql-actions.yaml
• .github/workflows/code-ql-javascript-typescript.yaml
• .github/workflows/code-ql-python.yaml
• .github/workflows/dependency-review.yaml
• .github/workflows/ossf-scorecard.yaml
• .github/workflows/pr-labeler.yaml
• .github/workflows/run-backend-tests.yaml
• .github/workflows/run-ci-cd.yaml
• .github/workflows/run-code-checks.yaml
• .github/workflows/run-code-tests.yaml
• .github/workflows/run-coverage-upload.yaml
• .github/workflows/run-dependency-checks.yaml
• .github/workflows/run-deploy.yaml
• .github/workflows/run-docksec-scan.yaml
• .github/workflows/run-e2e-tests.yaml
• .github/workflows/run-frontend-tests.yaml
• .github/workflows/run-fuzz-tests.yaml
• .github/workflows/run-image-build.yaml
• .github/workflows/run-image-scan.yaml
• .github/workflows/run-image-sign.yaml
• .github/workflows/run-infrastructure-bootstrap.yaml
• .github/workflows/run-infrastructure-tests.yaml
• .github/workflows/run-lighthouse-ci.yaml
• .github/workflows/run-release-version-resolution.yaml
• .github/workflows/run-zap-baseline-scan.yaml
• .github/zizmor.yml
• .pre-commit-config.yaml
• .trivyignore.yaml
• CONTRIBUTING.md
• backend/README.md
• backend/make/README.md
• backend/make/apps/owasp.mk
• backend/make/data.mk
• backend/make/image.mk
• backend/make/security.mk
• backend/makefile
• backend/poetry.toml
• backend/pyproject.toml
• backend/requirements/build.in
• backend/requirements/build.txt
• backend/src/apps/api/rest/v0/chapter.py
• backend/src/apps/api/rest/v0/committee.py
• backend/src/apps/api/rest/v0/project.py
• backend/src/apps/github/api/internal/queries/pull_request.py
• backend/src/apps/github/management/commands/github_update_owasp_organization.py
• backend/src/apps/github/models/repository_contributor.py
• backend/src/apps/owasp/api/internal/queries/chapter.py
• backend/src/apps/owasp/api/internal/queries/committee.py
• backend/src/apps/owasp/api/internal/queries/project.py
• backend/src/apps/owasp/api/internal/views/project_health_metrics.py
• backend/src/apps/owasp/api_client.py
• backend/src/apps/owasp/management/commands/owasp_scrape_chapters.py
• backend/src/apps/owasp/management/commands/owasp_scrape_projects.py
• backend/src/apps/owasp/management/commands/owasp_sync_chapters.py
• backend/src/apps/owasp/management/commands/owasp_sync_committees.py
• backend/src/apps/owasp/management/commands/owasp_sync_projects.py
• backend/src/apps/owasp/models/chapter.py
• backend/src/apps/owasp/models/committee.py
• backend/src/apps/owasp/models/managers/chapter.py
• backend/src/apps/owasp/models/mixins/chapter.py
• backend/src/apps/owasp/models/mixins/committee.py
• backend/src/apps/owasp/models/mixins/project.py
• backend/src/apps/owasp/models/project.py
• backend/src/apps/owasp/scraper.py
• backend/src/apps/owasp/sync.py
• backend/templates/ninja/swagger.html
• backend/tests/unit/apps/api/models/api_key_test.py
• backend/tests/unit/apps/api/rest/v0/chapter_test.py
• backend/tests/unit/apps/api/rest/v0/committee_test.py
• backend/tests/unit/apps/api/rest/v0/project_test.py
• backend/tests/unit/apps/github/api/internal/queries/pull_request_test.py
• backend/tests/unit/apps/github/management/commands/github_update_owasp_organization_test.py
• backend/tests/unit/apps/github/models/repository_contributor_test.py
• backend/tests/unit/apps/owasp/api/internal/queries/chapter_test.py
• backend/tests/unit/apps/owasp/api/internal/queries/committee_test.py
• backend/tests/unit/apps/owasp/api/internal/queries/project_test.py
• backend/tests/unit/apps/owasp/api_client_test.py
• backend/tests/unit/apps/owasp/management/commands/owasp_scrape_chapters_test.py
• backend/tests/unit/apps/owasp/management/commands/owasp_scrape_projects_test.py
• backend/tests/unit/apps/owasp/management/commands/owasp_sync_chapters_test.py
• backend/tests/unit/apps/owasp/management/commands/owasp_sync_committees_test.py
• backend/tests/unit/apps/owasp/management/commands/owasp_sync_projects_test.py
• backend/tests/unit/apps/owasp/models/chapter_test.py
• backend/tests/unit/apps/owasp/models/committee_test.py
• backend/tests/unit/apps/owasp/models/managers/managers_test.py
• backend/tests/unit/apps/owasp/models/mixins/chapter_test.py
• backend/tests/unit/apps/owasp/models/mixins/committee_test.py
• backend/tests/unit/apps/owasp/models/mixins/project_test.py
• backend/tests/unit/apps/owasp/models/project_test.py
• backend/tests/unit/apps/owasp/scraper_test.py
• backend/tests/unit/apps/owasp/sync_test.py
• cspell/custom-dict.txt
• cspell/makefile
• cspell/package.json
• cspell/pnpm-workspace.yaml
• docker-compose/e2e/compose.yaml
• docker-compose/fuzz/compose.yaml
• docker-compose/local/compose.yaml
• docker/backend/Dockerfile
• docker/backend/Dockerfile.fuzz-tests
• docker/backend/Dockerfile.local
• docker/backend/Dockerfile.unit-tests
• docker/code-checks/Dockerfile
• docker/docksec/Dockerfile
• docker/docs/Dockerfile.local
• docker/docs/Dockerfile.tests
• docker/e2e/Dockerfile
• docker/frontend/Dockerfile
• docker/frontend/Dockerfile.a11y-tests
• docker/frontend/Dockerfile.lighthouse
• docker/frontend/Dockerfile.local
• docker/frontend/Dockerfile.unit-tests
• docker/infrastructure/Dockerfile.tests
• docker/localstack/Dockerfile
• docker/osv-scanner/Dockerfile
• docker/semgrep/Dockerfile
• docker/tools/Dockerfile.security
• docker/tools/Dockerfile.tests
• docs/makefile
• docs/poetry.toml
• docs/pyproject.toml
• docs/serve.py
• docs/src/maintenance/index.md
• e2e/makefile
• e2e/package.json
• e2e/pages/ChapterDetails.spec.ts
• e2e/pages/ProjectDetails.spec.ts
• e2e/pnpm-workspace.yaml
• eslint.config.mjs
• frontend/README.md
• frontend/__tests__/unit/pages/BoardCandidatesPage.test.tsx
• frontend/__tests__/unit/pages/CreateModule.test.tsx
• frontend/__tests__/unit/utils/contributionDataUtils.test.ts
• frontend/jest.config.ts
• frontend/make/README.md
• frontend/make/image.mk
• frontend/make/security.mk
• frontend/makefile
• frontend/next.config.ts
• frontend/package.json
• frontend/pnpm-workspace.yaml
• frontend/src/app/board/[year]/candidates/page.tsx
• frontend/src/utils/contributionDataUtils.ts
• infrastructure/bootstrap/.terraform.lock.hcl
• infrastructure/bootstrap/README.md
• infrastructure/bootstrap/main.tf
• infrastructure/live/.terraform.lock.hcl
• infrastructure/live/README.md
• infrastructure/live/main.tf
• infrastructure/make/README.md
• infrastructure/makefile
• infrastructure/modules/alb/.terraform.lock.hcl
• infrastructure/modules/alb/README.md
• infrastructure/modules/alb/main.tf
• infrastructure/modules/cache/.terraform.lock.hcl
• infrastructure/modules/cache/README.md
• infrastructure/modules/cache/main.tf
• infrastructure/modules/database/.terraform.lock.hcl
• infrastructure/modules/database/README.md
• infrastructure/modules/database/main.tf
• infrastructure/modules/ecr-cache/.terraform.lock.hcl
• infrastructure/modules/ecr-cache/README.md
• infrastructure/modules/ecr-cache/main.tf
• infrastructure/modules/kms/.terraform.lock.hcl
• infrastructure/modules/kms/README.md
• infrastructure/modules/kms/main.tf
• infrastructure/modules/networking/.terraform.lock.hcl
• infrastructure/modules/networking/README.md
• infrastructure/modules/networking/main.tf
• infrastructure/modules/networking/modules/nacl/.terraform.lock.hcl
• infrastructure/modules/networking/modules/nacl/README.md
• infrastructure/modules/networking/modules/nacl/main.tf
• infrastructure/modules/networking/modules/vpc-endpoint/.terraform.lock.hcl
• infrastructure/modules/networking/modules/vpc-endpoint/README.md
• infrastructure/modules/networking/modules/vpc-endpoint/main.tf
• infrastructure/modules/parameters/.terraform.lock.hcl
• infrastructure/modules/parameters/README.md
• infrastructure/modules/parameters/main.tf
• infrastructure/modules/security/.terraform.lock.hcl
• infrastructure/modules/security/README.md
• infrastructure/modules/security/main.tf
• infrastructure/modules/service/.terraform.lock.hcl
• infrastructure/modules/service/README.md
• infrastructure/modules/service/main.tf
• infrastructure/modules/storage/.terraform.lock.hcl
• infrastructure/modules/storage/README.md
• infrastructure/modules/storage/main.tf
• infrastructure/modules/storage/modules/s3-bucket/.terraform.lock.hcl
• infrastructure/modules/storage/modules/s3-bucket/README.md
• infrastructure/modules/storage/modules/s3-bucket/main.tf
• infrastructure/modules/storage/modules/shared-data-bucket/.terraform.lock.hcl
• infrastructure/modules/storage/modules/shared-data-bucket/README.md
• infrastructure/modules/storage/modules/shared-data-bucket/main.tf
• infrastructure/modules/tasks/.terraform.lock.hcl
• infrastructure/modules/tasks/README.md
• infrastructure/modules/tasks/main.tf
• infrastructure/modules/tasks/modules/task/.terraform.lock.hcl
• infrastructure/modules/tasks/modules/task/README.md
• infrastructure/modules/tasks/modules/task/main.tf
• infrastructure/state/.terraform.lock.hcl
• infrastructure/state/README.md
• infrastructure/state/main.tf
• make/README.md
• make/security.mk
• makefile
• package.json
• pnpm-workspace.yaml
• ruff.toml
• tools/makefile
• tools/requirements/pre-commit.in
• tools/requirements/pre-commit.txt
• tools/security/docksec_scan.py
• tools/tests/security/docksec_scan_test.py

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Contribution validation failed:

• commit_sign_off: One or more commits are missing or have an invalid Signed-off-by trailer.
  • 746fdae

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 90.50736% with 58 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.60%. Comparing base (0376252) to head (eeaf136).
⚠️ Report is 1 commits behind head on feature/o11y.

Files with missing lines	Patch %	Lines
...s/owasp/management/commands/owasp_sync_projects.py	76.55%	17 Missing and 17 partials ⚠️
...s/owasp/management/commands/owasp_sync_chapters.py	87.50%	8 Missing and 7 partials ⚠️
backend/src/apps/owasp/models/project.py	90.69%	1 Missing and 3 partials ⚠️
backend/src/apps/owasp/sync.py	97.65%	1 Missing and 2 partials ⚠️
backend/src/apps/owasp/api_client.py	96.82%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@               Coverage Diff                @@
##           feature/o11y    #5738      +/-   ##
================================================
- Coverage         98.89%   98.60%   -0.30%     
================================================
  Files               555      556       +1     
  Lines             18165    18542     +377     
  Branches           2611     2697      +86     
================================================
+ Hits              17965    18284     +319     
- Misses               99      126      +27     
- Partials            101      132      +31     

Flag	Coverage Δ
backend	99.00% <90.50%> (-0.40%)	⬇️
frontend	97.37% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
backend/src/apps/api/rest/v0/chapter.py	100.00% <100.00%> (ø)
backend/src/apps/api/rest/v0/committee.py	100.00% <100.00%> (ø)
backend/src/apps/api/rest/v0/project.py	100.00% <100.00%> (ø)
...c/apps/github/api/internal/queries/pull_request.py	100.00% <100.00%> (ø)
...ement/commands/github_update_owasp_organization.py	100.00% <100.00%> (ø)
...d/src/apps/github/models/repository_contributor.py	100.00% <100.00%> (ø)
...end/src/apps/owasp/api/internal/queries/chapter.py	100.00% <100.00%> (ø)
...d/src/apps/owasp/api/internal/queries/committee.py	100.00% <100.00%> (ø)
...end/src/apps/owasp/api/internal/queries/project.py	100.00% <100.00%> (ø)
...owasp/api/internal/views/project_health_metrics.py	100.00% <100.00%> (ø)
... and 12 more

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2800bf8...eeaf136. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cubic-dev-ai]

35 issues found across 229 files

Confidence score: 2/5

• api_client.py can treat a server-capped page as the end of the catalog, causing sync to deactivate or delete rows that were never fetched. Continue until the client receives an empty page.
• Dockerfile runs as nobody, but the OSV scan mounts its writable cache under /root/.cache/osv-scanner, which that user cannot write. Move the cache to a writable location.
• project.py builds legacy owasp_url values with the www-project- prefix, producing incorrect public URLs. Strip the prefix when building the URL.
• committee.py still filters inactive committees from detail lookups, so their details are not addressable. Pass active_only=False for this lookup.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="backend/tests/unit/apps/github/models/repository_contributor_test.py">

<violation number="1" location="backend/tests/unit/apps/github/models/repository_contributor_test.py:159">
P3: This test does not check that `Project.get_by_key` is called with `active_only=False`. Capture the patch as `mock_get` and assert `mock_get.assert_called_once_with("my-project", active_only=False)`.</violation>

<violation number="2" location="backend/tests/unit/apps/github/models/repository_contributor_test.py:175">
P2: The updated chapter and committee tests only cover a found entity with a linked repository. Add a case where `get_by_key` returns `None` (or `owasp_repository_id=None`) and assert the result is empty, so the no-fallback behavior is locked in.</violation>
</file>

<file name="backend/src/apps/api/rest/v0/committee.py">

<violation number="1" location="backend/src/apps/api/rest/v0/committee.py:86">
P2: This detail lookup still excludes inactive committees because `get_by_key` defaults to `active_only=True`. Pass `active_only=False` so inactive committee details remain addressable.

(Based on your team's feedback about inactive detail lookups.) [d3a37984-5374-4bf4-abfc-8b9faca2d632]</violation>
</file>

<file name="backend/make/apps/owasp.mk">

<violation number="1" location="backend/make/apps/owasp.mk:73">
P2: The replacement removes the three established `owasp-scrape-*` make targets without aliases, breaking existing automation. Keep compatibility targets that delegate to the corresponding `owasp-sync-*` commands.</violation>
</file>

<file name=".docksec-ignore.yml">

<violation number="1" location=".docksec-ignore.yml:2">
P2: This repository-wide `DS002` waiver also disables DockSec's non-root check for application Dockerfiles, although the reason only covers tool images. Remove the global waiver or use a path-scoped exemption so production images remain gated.</violation>
</file>

<file name="frontend/package.json">

<violation number="1" location="frontend/package.json:36">
P2: `isomorphic-dompurify` 4.3.0 requires Node `^22.22.2 || ^24.15.0 || >=26.0.0`, but this package's `engines` is `^24.0.0`, which allows Node 24.0–24.14. Either raise the `engines.node` floor to `>=24.15.0` or pin an older `isomorphic-dompurify` that supports earlier Node 24 releases.</violation>
</file>

<file name="backend/tests/unit/apps/owasp/models/mixins/chapter_test.py">

<violation number="1" location="backend/tests/unit/apps/owasp/models/mixins/chapter_test.py:66">
P3: This test is named and documented as 'without repository', but the fixture only sets `is_empty=True` and still attaches a repository mock. To test the no-repository case, set `owasp_repository` to `None` explicitly.</violation>
</file>

<file name=".github/zizmor.yml">

<violation number="1" location=".github/zizmor.yml:12">
P2: This disables the `self-repository` audit for every workflow in the repo, though the stated reason only applies to the `uses: ./...` references. Scope the suppression with an `ignore:` list for the affected workflow files, as the `dangerous-triggers` entry already does. That keeps the audit active for new workflows and for any future in-repo reference that could run under a dangerous trigger.</violation>
</file>

<file name=".pre-commit-config.yaml">

<violation number="1" location=".pre-commit-config.yaml:100">
P2: The mypy hook pins `strawberry-graphql` and `strawberry-graphql-django` to versions that differ from `backend/poetry.lock` (0.327.2 and 0.75.3). Pin these to the locked versions so mypy checks the code against the dependencies it runs with.</violation>
</file>

<file name="backend/tests/unit/apps/owasp/models/committee_test.py">

<violation number="1" location="backend/tests/unit/apps/owasp/models/committee_test.py:118">
P3: The new `get_by_key` tests only cover the default `active_only=True` path. Add a case that calls `Committee.get_by_key("events", active_only=False)` and asserts the query runs against `Committee.objects`, so the inactive-inclusive lookup is covered.</violation>
</file>

<file name="backend/tests/unit/apps/owasp/sync_test.py">

<violation number="1" location="backend/tests/unit/apps/owasp/sync_test.py:145">
P3: This assertion is too weak to catch regressions in redirect following. Assert `mock_session.get.call_count == 2` so the test verifies the redirect is followed exactly once.</violation>
</file>

<file name="backend/tests/unit/apps/owasp/models/project_test.py">

<violation number="1" location="backend/tests/unit/apps/owasp/models/project_test.py:333">
P3: The new `get_by_key` tests only cover the default `active_only=True` path. Add a test for `active_only=False`, which searches `Project.objects` and is used by several production callers.</violation>
</file>

<file name="e2e/package.json">

<violation number="1" location="e2e/package.json:3">
P2: The Playwright npm package is now 1.64.0, but the e2e Docker base image is `mcr.microsoft.com/playwright:v1.64.1`. Playwright pins browser builds per release, so a patch mismatch can make `playwright test` fail with a missing browser executable. Pin the image tag to v1.64.0, or bump this package to 1.64.1 so both match.</violation>
</file>

<file name="backend/tests/unit/apps/github/management/commands/github_update_owasp_organization_test.py">

<violation number="1" location="backend/tests/unit/apps/github/management/commands/github_update_owasp_organization_test.py:62">
P2: The `Project.update_data` and `Chapter.update_data` assertions in `test_handle` can no longer fail: the command never calls them and `sync_repository` is mocked. Assert `mock_sync_repository.assert_not_called()` for the `www-project-` and `www-chapter-` cases, and assert the sync call count for the non-skipped repos.</violation>
</file>

<file name="frontend/src/utils/contributionDataUtils.ts">

<violation number="1" location="frontend/src/utils/contributionDataUtils.ts:62">
P2: `contributionCount` falls back to the `www-chapter-` key even when the chapter has no linked repository. For chapter lookups, count only the chapter's linked repository and return 0 otherwise. Keep the legacy fallback out of this path, or gate it on the linked repository.</violation>
</file>

<file name=".trivyignore.yaml">

<violation number="1" location=".trivyignore.yaml:12">
P3: This suppresses DS-0002 for `docker/docksec/Dockerfile`, which has no `USER` directive. The osv-scanner Dockerfile shows `USER nobody` is workable, so consider adding it to docksec and leaving it off this ignore list instead.</violation>
</file>

<file name="backend/src/apps/github/models/repository_contributor.py">

<violation number="1" location="backend/src/apps/github/models/repository_contributor.py:170">
P2: `Chapter.get_by_key` defaults to `active_only=True`, so inactive chapters now return no contributors. The chapter detail query uses `active_only=False`, so these chapter pages still render and would show an empty contributor list. Pass `active_only=False` here, as the project branch does.

(Based on your team's feedback about including inactive detail lookups.)</violation>
</file>

<file name="backend/tests/unit/apps/owasp/management/commands/owasp_sync_projects_test.py">

<violation number="1" location="backend/tests/unit/apps/owasp/management/commands/owasp_sync_projects_test.py:45">
P2: New reconciliation branches have no tests: a slug held by a project that already has repositories, the claimed_ids collision fallback, and legacy `www-project-` project_url matching. Add cases for each so regressions in project-to-repository matching are caught.</violation>
</file>

<file name="backend/src/apps/owasp/api_client.py">

<violation number="1" location="backend/src/apps/owasp/api_client.py:86">
P1: Stopping on a short page assumes the server honors `limit=1000`. If it caps page size lower, the client silently returns a partial catalog, and the sync then deactivates or deletes the missing rows. Stop on an empty page and advance the offset by the number of records actually returned.</violation>

<violation number="2" location="backend/src/apps/owasp/api_client.py:133">
P3: `Retry-After` is passed straight to `time.sleep` with no upper bound, so an unusually large value stalls the sync for that long. Cap the delay.</violation>
</file>

<file name="backend/src/apps/owasp/management/commands/owasp_sync_committees.py">

<violation number="1" location="backend/src/apps/owasp/management/commands/owasp_sync_committees.py:61">
P2: An empty `found_urls` now returns early, so stored `related_urls` and `invalid_urls` are never cleared. Before this PR, a committee page that lost all its external links reset both lists to `[]`. If keeping the old values is intended, document it and add a test. Otherwise, remove this branch so the loop clears the lists.</violation>
</file>

<file name="backend/src/apps/owasp/models/mixins/committee.py">

<violation number="1" location="backend/src/apps/owasp/models/mixins/committee.py:20">
P2: `idx_key` now returns the raw stored key, so committee search cards link to `/committees/www-committee-<slug>`. The lookup still resolves through `Committee.get_by_key`, but the URL no longer matches the public slug that `Committee.nest_key` produces. If the raw key is intended, keep the change; otherwise return `self.nest_key` here.</violation>
</file>

<file name="tools/security/docksec_scan.py">

<violation number="1" location="tools/security/docksec_scan.py:61">
P2: Symlinked Dockerfiles are dropped without any log, so the scan reports success while skipping them. Log a warning for each skipped symlink in `discover_dockerfiles` so the gap is visible in CI output.</violation>
</file>

<file name="backend/src/apps/owasp/models/project.py">

<violation number="1" location="backend/src/apps/owasp/models/project.py:341">
P2: `owasp_url` now inherits the `www-project-` prefix from `nest_key` for legacy rows. The public URL becomes `/projects/www-project-x`, which is wrong. Strip the legacy prefix in `owasp_url`, or confirm that every prefixed row is renamed.</violation>
</file>

<file name="backend/src/apps/owasp/models/committee.py">

<violation number="1" location="backend/src/apps/owasp/models/committee.py:72">
P2: `Committee.nest_key` now identifies the group slug, but inherited `owasp_url` still builds `https://owasp.org/{key}`. Override it to return `/groups/{nest_key}-committee` so API, admin, and index links reach the public committee page.</violation>

<violation number="2" location="backend/src/apps/owasp/models/committee.py:76">
P3: This `get_by_key` duplicates the Chapter and Project versions almost line for line. Move the shared exact-then-prefix-fallback lookup into one helper, parameterized by the manager and prefix.</violation>
</file>

<file name="backend/src/apps/owasp/sync.py">

<violation number="1" location="backend/src/apps/owasp/sync.py:198">
P2: `get_urls` calls `urlparse(href)` without guarding it. A malformed href such as `http://[abc` raises `ValueError`, which aborts the whole sync run. Skip such hrefs with `except ValueError`, as `models/common.py` already does.</violation>

<violation number="2" location="backend/src/apps/owasp/sync.py:226">
P3: The suffix check has no dot boundary, so unrelated hosts such as `notlinkedin.com` skip verification. Reuse `host_matches`, which requires an exact match or a dot-separated subdomain.</violation>

<violation number="3" location="backend/src/apps/owasp/sync.py:256">
P2: A 5xx or 429 that persists after retries makes `verify_url` return `None`, so the link is recorded as invalid. The docstring says only request failures keep the URL, so these inconclusive responses should keep it too. Return `url` for server-side and rate-limit responses before the warning.</violation>
</file>

<file name="backend/src/apps/api/rest/v0/project.py">

<violation number="1" location="backend/src/apps/api/rest/v0/project.py:140">
P2: This detail lookup still excludes inactive projects because `get_by_key` defaults to `active_only=True`. Pass `active_only=False` so inactive project details remain accessible.

(Based on your team's feedback about inactive detail lookups.) [d3a37984-5374-4bf4-abfc-8b9faca2d632]</violation>
</file>

<file name="backend/src/apps/api/rest/v0/chapter.py">

<violation number="1" location="backend/src/apps/api/rest/v0/chapter.py:136">
P2: This detail lookup still excludes inactive chapters because `get_by_key` defaults to `active_only=True`. Pass `active_only=False` so inactive chapter detail pages do not return 404.

(Based on your team's feedback about inactive detail lookups.) [d3a37984-5374-4bf4-abfc-8b9faca2d632]</violation>
</file>

<file name="backend/src/apps/owasp/api/internal/queries/committee.py">

<violation number="1" location="backend/src/apps/owasp/api/internal/queries/committee.py:26">
P2: This resolver now hides inactive committees because `get_by_key` defaults to `active_only=True`, unlike the previous all-rows lookup. Pass `active_only=False` for detail resolution.

(Based on your team's feedback about inactive detail lookups.) [d3a37984-5374-4bf4-abfc-8b9faca2d632]</violation>
</file>

<file name="backend/src/apps/owasp/models/mixins/project.py">

<violation number="1" location="backend/src/apps/owasp/models/mixins/project.py:79">
P2: The fallback now exposes the legacy `www-project-` storage prefix in indexed project names. Strip that prefix before formatting unnamed legacy projects.</violation>
</file>

<file name=".github/workflows/run-docksec-scan.yaml">

<violation number="1" location=".github/workflows/run-docksec-scan.yaml:16">
P2: `makefile` is the repository's root make entrypoint, but this filter watches nonexistent `Makefile`. Changes to the file defining `security-docksec-scan` will not trigger this workflow; change the path to `makefile`.</violation>
</file>

<file name="docker/osv-scanner/Dockerfile">

<violation number="1" location="docker/osv-scanner/Dockerfile:3">
P1: `USER nobody` breaks the existing OSV scan invocation because it mounts the writable cache under `/root/.cache/osv-scanner`, which this user cannot write. Move the cache to a location and ownership accessible to the container user, or adjust the invocation before enabling this user.</violation>
</file>

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Stopping on a short page assumes the server honors limit=1000. If it caps page size lower, the client silently returns a partial catalog, and the sync then deactivates or deletes the missing rows. Stop on an empty page and advance the offset by the number of records actually returned.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At backend/src/apps/owasp/api_client.py, line 86:

<comment>Stopping on a short page assumes the server honors `limit=1000`. If it caps page size lower, the client silently returns a partial catalog, and the sync then deactivates or deletes the missing rows. Stop on an empty page and advance the offset by the number of records actually returned.</comment>

<file context>
@@ -0,0 +1,160 @@
+                )
+                return None
+
+            records.extend(page)
+            if len(page) < self.page_limit:
+                return records
</file context>

Suggested change

	records.extend(page)
	if len(page) < self.page_limit:
	return records
	previous_page = page
	page_offset += self.page_limit
	if not page:
	return records
	records.extend(page)
	previous_page = page
	page_offset += len(page)

[cubic-dev-ai]

P1: USER nobody breaks the existing OSV scan invocation because it mounts the writable cache under /root/.cache/osv-scanner, which this user cannot write. Move the cache to a location and ownership accessible to the container user, or adjust the invocation before enabling this user.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At docker/osv-scanner/Dockerfile, line 3:

<comment>`USER nobody` breaks the existing OSV scan invocation because it mounts the writable cache under `/root/.cache/osv-scanner`, which this user cannot write. Move the cache to a location and ownership accessible to the container user, or adjust the invocation before enabling this user.</comment>

<file context>
@@ -1 +1,3 @@
-FROM ghcr.io/google/osv-scanner:v2.6.0@sha256:afd838850ac1a0fcc15ff4a041dc9ba11123c3f0d2666217a5f0fcf9222b55fa
+FROM ghcr.io/google/osv-scanner:v2.7.0@sha256:4f3b7e2c64b9d38a5febc5a7e4a3dfef1d1362f726dea7a2ef4762b46469fcd0
+
+USER nobody
</file context>

[cubic-dev-ai]

P2: The updated chapter and committee tests only cover a found entity with a linked repository. Add a case where get_by_key returns None (or owasp_repository_id=None) and assert the result is empty, so the no-fallback behavior is locked in.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At backend/tests/unit/apps/github/models/repository_contributor_test.py, line 175:

<comment>The updated chapter and committee tests only cover a found entity with a linked repository. Add a case where `get_by_key` returns `None` (or `owasp_repository_id=None`) and assert the result is empty, so the no-fallback behavior is locked in.</comment>

<file context>
@@ -163,17 +167,25 @@ def test_get_top_contributors_chapter_filter(self):
+                return_value=Mock(owasp_repository_id=7),
+            ) as mock_get:
+                RepositoryContributor.get_top_contributors(chapter="my-chapter")
+            mock_get.assert_called_once_with("my-chapter")
+            mock_queryset.filter.assert_any_call(repository_id=7)
 
</file context>

[cubic-dev-ai]

P2: This detail lookup still excludes inactive committees because get_by_key defaults to active_only=True. Pass active_only=False so inactive committee details remain addressable.

(Based on your team's feedback about inactive detail lookups.) [d3a37984-5374-4bf4-abfc-8b9faca2d632]

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At backend/src/apps/api/rest/v0/committee.py, line 86:

<comment>This detail lookup still excludes inactive committees because `get_by_key` defaults to `active_only=True`. Pass `active_only=False` so inactive committee details remain addressable.

(Based on your team's feedback about inactive detail lookups.) [d3a37984-5374-4bf4-abfc-8b9faca2d632]</comment>

<file context>
@@ -83,14 +83,7 @@ def get_committee(
-            else f"www-committee-{committee_id}"
-        ),
-    ).first():
+    if committee := CommitteeModel.get_by_key(committee_id):
         return committee
 
</file context>

Suggested change

	if committee := CommitteeModel.get_by_key(committee_id):
	if committee := CommitteeModel.get_by_key(committee_id, active_only=False):

[cubic-dev-ai]

P2: The replacement removes the three established owasp-scrape-* make targets without aliases, breaking existing automation. Keep compatibility targets that delegate to the corresponding owasp-sync-* commands.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At backend/make/apps/owasp.mk, line 73:

<comment>The replacement removes the three established `owasp-scrape-*` make targets without aliases, breaking existing automation. Keep compatibility targets that delegate to the corresponding `owasp-sync-*` commands.</comment>

<file context>
@@ -70,21 +70,21 @@ owasp-process-snapshots:
-owasp-scrape-chapters:
-	@echo "Scraping OWASP site chapters data"
-	@CMD="python manage.py owasp_scrape_chapters" $(MAKE) backend-exec-command
+owasp-sync-chapters:
+	@echo "Syncing OWASP chapters"
+	@CMD="python manage.py owasp_sync_chapters" $(MAKE) backend-exec-command
</file context>

[cubic-dev-ai]

P3: The new get_by_key tests only cover the default active_only=True path. Add a test for active_only=False, which searches Project.objects and is used by several production callers.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At backend/tests/unit/apps/owasp/models/project_test.py, line 333:

<comment>The new `get_by_key` tests only cover the default `active_only=True` path. Add a test for `active_only=False`, which searches `Project.objects` and is used by several production callers.</comment>

<file context>
@@ -253,10 +300,72 @@ def test_leaders_count(self):
+
+        assert project.github_url == "https://github.com/OWASP/CheatSheetSeries"
+
+    def test_get_by_key_checks_the_slug_before_the_legacy_key(self, mocker):
+        """Test lookup matches the project key."""
+        found = mocker.Mock()
</file context>

Suggested change

	def test_get_by_key_checks_the_slug_before_the_legacy_key(self, mocker):
	def test_get_by_key_includes_inactive_projects(self, mocker):
	"""Test active_only=False looks up all projects, not only active ones."""
	found = mocker.Mock()
	manager = mocker.Mock()
	manager.filter.return_value.first.return_value = found
	mocker.patch.object(Project, "objects", manager)
	assert Project.get_by_key("cheat-sheet-series", active_only=False) is found
	manager.filter.assert_called_once_with(key__iexact="cheat-sheet-series")
	def test_get_by_key_checks_the_slug_before_the_legacy_key(self, mocker):

[cubic-dev-ai]

P3: This suppresses DS-0002 for docker/docksec/Dockerfile, which has no USER directive. The osv-scanner Dockerfile shows USER nobody is workable, so consider adding it to docksec and leaving it off this ignore list instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .trivyignore.yaml, line 12:

<comment>This suppresses DS-0002 for `docker/docksec/Dockerfile`, which has no `USER` directive. The osv-scanner Dockerfile shows `USER nobody` is workable, so consider adding it to docksec and leaving it off this ignore list instead.</comment>

<file context>
@@ -9,9 +9,9 @@ misconfigurations:
     paths:
       - .clusterfuzzlite/Dockerfile
       - docker/code-checks/Dockerfile
+      - docker/docksec/Dockerfile
       - docker/e2e/Dockerfile
       - docker/localstack/Dockerfile
</file context>

[cubic-dev-ai]

P3: Retry-After is passed straight to time.sleep with no upper bound, so an unusually large value stalls the sync for that long. Cap the delay.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At backend/src/apps/owasp/api_client.py, line 133:

<comment>`Retry-After` is passed straight to `time.sleep` with no upper bound, so an unusually large value stalls the sync for that long. Cap the delay.</comment>

<file context>
@@ -0,0 +1,160 @@
+
+            if attempt == 0:
+                retry_after = response.headers.get("Retry-After")
+                time.sleep(int(retry_after) if retry_after and retry_after.isdigit() else 1)
+
+        if response is None or response.status_code != HTTPStatus.OK:
</file context>

Suggested change

	time.sleep(int(retry_after) if retry_after and retry_after.isdigit() else 1)
	delay = int(retry_after) if retry_after and retry_after.isdigit() else 1
	time.sleep(min(delay, 60))

[cubic-dev-ai]

P3: This get_by_key duplicates the Chapter and Project versions almost line for line. Move the shared exact-then-prefix-fallback lookup into one helper, parameterized by the manager and prefix.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At backend/src/apps/owasp/models/committee.py, line 76:

<comment>This `get_by_key` duplicates the Chapter and Project versions almost line for line. Move the shared exact-then-prefix-fallback lookup into one helper, parameterized by the manager and prefix.</comment>

<file context>
@@ -56,9 +58,46 @@ def save(self, *args, **kwargs) -> None:
+        return self.key
+
+    @classmethod
+    def get_by_key(cls, key: str, *, active_only: bool = True) -> Committee | None:
+        """Return the committee stored under this key.
+
</file context>

[cubic-dev-ai]

P3: The suffix check has no dot boundary, so unrelated hosts such as notlinkedin.com skip verification. Reuse host_matches, which requires an exact match or a dot-separated subdomain.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At backend/src/apps/owasp/sync.py, line 226:

<comment>The suffix check has no dot boundary, so unrelated hosts such as `notlinkedin.com` skip verification. Reuse `host_matches`, which requires an exact match or a dot-separated subdomain.</comment>

<file context>
@@ -0,0 +1,257 @@
+        location = urlparse(url).netloc.lower()
+        if not location:
+            return None
+        if location.endswith(("linkedin.com", "slack.com", "youtube.com")):
+            return url
+
</file context>

Suggested change

	if location.endswith(("linkedin.com", "slack.com", "youtube.com")):
	if any(
	self.host_matches(location, domain) for domain in ("linkedin.com", "slack.com", "youtube.com")
	):