Sync Agent Kit generated artifacts (566a9aa905d8) - #31
Conversation
![endor-agent-kit-sync[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
ff08696 to
a073340
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff08696951
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| @@ -181,13 +173,23 @@ Use namespace-scoped main-context AI SAST findings, exploit reproduction, remedi | |||
| ### Evidence Query Recipes | |||
|
|
|||
| - `finding-by-uuid`/evidence-check: `endorctl api get -r Finding -n <namespace> --uuid <FINDING_UUID> -o json` | |||
| - `ai-sast-list`/evidence-check: `endorctl api list -r Finding -n <namespace> --filter 'context.type==CONTEXT_TYPE_MAIN and spec.project_uuid=="<PROJECT_UUID>" and spec.method=="SYSTEM_EVALUATION_METHOD_DEFINITION_AI_SAST"' --field-mask "uuid,context.type,spec.project_uuid,spec.method,spec.source_code_version,spec.finding_metadata" --list-all -o json` | |||
There was a problem hiding this comment.
When the workflow lists project AI SAST findings, the earlier instructions require parsing each finding's spec.explanation for classification, scorecards, data flow, exploit reproduction, and remediation guidance, but this new --field-mask excludes spec.explanation. In any multi-finding triage where the agent follows the ai-sast-list recipe before selecting details, the returned rows won't contain the case file it needs to rank or classify findings, so it will either produce data_gaps or make decisions without the required evidence.
Useful? React with 👍 / 👎.
| @@ -143,13 +136,23 @@ Correlate external malware package/version intelligence with Endor tenant packag | |||
| ### Evidence Query Recipes | |||
|
|
|||
| - `tenant-package-version-exact`/exposure-check: `endorctl api list -r PackageVersion -n <namespace> --traverse --filter 'context.type==CONTEXT_TYPE_MAIN and meta.name=="<PACKAGE_URL_PREFIX>://<PACKAGE_NAME>@<VERSION>"' --field-mask "uuid,meta.name,meta.parent_uuid,meta.create_time,meta.update_time,context.type,spec.project_uuid,spec.relative_path" --list-all -o json` | |||
| - `tenant-package-inventory`/exposure-check: `endorctl api list -r PackageVersion -n <namespace> --traverse --filter 'context.type==CONTEXT_TYPE_MAIN and meta.name matches "<PACKAGE_URL_PREFIX>://<PACKAGE_NAME>@.*"' --field-mask "uuid,meta.name,meta.parent_uuid,meta.create_time,meta.update_time,context.type,spec.project_uuid,spec.relative_path" --list-all -o json` | |||
| - `tenant-malware-findings`/exposure-check: `endorctl api list -r Finding -n <namespace> --filter 'context.type==CONTEXT_TYPE_MAIN and spec.finding_categories contains FINDING_CATEGORY_MALWARE and spec.dismiss==false' --field-mask "uuid,context.type,spec.project_uuid,spec.level,spec.finding_categories,spec.ecosystem,spec.target_dependency_package_name,spec.target_dependency_version,spec.finding_metadata" -o json` | |||
There was a problem hiding this comment.
For parent-namespace malware response, the compact contract says the default scope is the namespace plus child namespaces, and the adjacent PackageVersion recipes already use --traverse; this new malware Finding query does not. If Endor's malware-category finding is in a child namespace, the agent can miss Endor's own verdict and report only external intelligence or a false data gap despite the tenant being in scope.
Useful? React with 👍 / 👎.
1 participant
Source
Generated from
endorlabs/endor-labs-agent-kit@566a9aa905d830750366b654d8b4ed1572bdbaf3after Agent Kit CI validation.Validation
endor-agent-kit validateandauthoring-checkfor every source recipepython -m pytest -qendor-agent-kit publish ... --include-pluginsendor-agent-kit check-guardrails --catalog-root .endor-agent-kit verify-provenance --catalog-root .Provenance
8385c64410395143ec9d4354aca1d66f19ad89dabd41b97b80870c2248212f654e4c236a12ae3cceb94077f966db13892ecc236cb6e010ed57b6ec0cb25e3db4github.com/endorlabs/ai-plugins/agent-kit-catalog-provenance@sha256:4e4c236a12ae3cceb94077f966db13892ecc236cb6e010ed57b6ec0cb25e3db4ENDOR_ARTIFACT_SIGNING_ENABLED=trueandENDOR_NAMESPACErepository variables are configuredMaintainer Checks