| name | chapar-cve-checker |
| description | Modify or debug Chapar CVE checker agent behavior, security scan config, Nemotron summaries, issue dedupe, systemd units, or the GitHub Actions CVE workflow. Use for ci/cve-checker.py, ci/cve-checker-config.json, docs/cve-checker.md, etc/systemd CVE files, or .github/workflows/cve-checker.yml. |
Chapar CVE Checker
Use this playbook for the hpcsim CVE checker agent and its deployment workflow.
The checker is intentionally a security scanner, not a builder or remediation
agent.
Trust Boundary
- Do not give the checker access to
/resources, Incus, Docker sockets, SSH
credentials, user home directories, or repository write credentials.
- Do not run Spack installs or build workflows from the CVE checker.
- Keep unattended runs dry-run unless the existing live-mode controls are
deliberately enabled.
- Keep CVE matching deterministic. Nemotron may summarize confirmed findings but
must not decide whether a CVE matches a package.
- Do not include secrets, tokens, API keys, or live environment files in git.
Key Files
ci/cve-checker.py
ci/cve-checker-config.json
ci/install-cve-checker-nemoclaw.sh
ci/register-nemoclaw-runner.sh
docs/cve-checker.md
etc/cve-checker.env.example
etc/systemd/chapar-cve-checker.service
etc/systemd/chapar-cve-checker.timer
etc/systemd/chapar-cve-checker.network-allowlist.conf.example
.github/workflows/cve-checker.yml
Change Guidance
- Put package aliases, skips, severity threshold, lookback, and query templates in
ci/cve-checker-config.json unless Python behavior must change.
- Keep issue dedupe markers stable so reruns do not create duplicate GitHub
issues.
- Keep manual GitHub workflow dispatch dry-run by default.
- Scheduled live issue creation must remain gated by
CHAPAR_CVE_LIVE or an
equivalent explicit repository variable.
- Network allowlisting belongs in systemd/proxy deployment docs, not in ad-hoc
Python bypasses.
- When touching issue text, preserve enough evidence for a human to verify the
package, version, CVE, source URL, severity, and deterministic match reason.
Triage Workflow
- Identify whether the failure is config parsing, package inventory extraction,
NVD/OSV querying, Nemotron summarization, GitHub issue creation, dedupe state,
systemd sandboxing, or GitHub Actions runner setup.
- For workflow failures, inspect run metadata before changing code:
gh run list --workflow cve-checker.yml --limit 10
gh run view <run-id> --json jobs,conclusion,displayTitle,headSha,headBranch,event
- For systemd deployment issues, prefer docs and unit hardening fixes over
broadening the runtime user's privileges.
Validation
python3 -m py_compile ci/cve-checker.py
python3 -m json.tool ci/cve-checker-config.json >/dev/null
bash -n ci/install-cve-checker-nemoclaw.sh
bash -n ci/register-nemoclaw-runner.sh
git diff --check
For behavior smoke tests, use dry-run mode and a small package limit. Do not run
live issue creation unless the user explicitly asks.
