Skip to content

Add basic replication break glass - #112

Merged
DamianZaremba merged 4 commits into
mainfrom
feature/add-basic-replication-break-glass
Aug 31, 2026
Merged

Add basic replication break glass#112
DamianZaremba merged 4 commits into
mainfrom
feature/add-basic-replication-break-glass

Conversation

@DamianZaremba

@DamianZaremba DamianZaremba commented Aug 31, 2026

Copy link
Copy Markdown
Member
  • Metrics - support disabling seed per metric
  • doInit - explicitly set bot_start_time
  • Metrics - do not reset last contribution time
  • Add basic replica lag handling

@DamianZaremba
Metrics - support disabling seed per metric
44081d0
@DamianZaremba
doInit - explicitly set bot_start_time
3c01432
@DamianZaremba
Metrics - do not reset last contribution time
7bae3ec
@DamianZaremba
Add basic replica lag handling
c22f323 
- Check the wiki replica lag every 1 min
- If the current lag is more than 1 min then pause consuming events
- If the lag returns to less than 10 seconds then resume consuming

This should have the following effects when replicas are lagged;
- Edit checks will be delayed, but will happen for anon users
- Data will be consisted (and reproducible for review)
- Some edits that could have been scored, will be delayed, but have
  correct data

Currently if the wiki replicas are lagged for several hours/days the bot
genearlly stops, with a handful of reverts being done, then self-heals
with all edits in the time period missed.

This adjusts the self-healing to try and handle the back-log, which may
delay real-time resumption, but we'll find out if that is an issue
later.
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown

Trivy Security Scan

cnb/lifecycle/launcher

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib v1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib v1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib 1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib 1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

@DamianZaremba

DamianZaremba commented Aug 31, 2026

Copy link
Copy Markdown
Member Author

This has been running for a few days and appears to be working (no replication issues to test that part though)

@DamianZaremba
DamianZaremba merged commit 6ac6fb6 into main Aug 31, 2026
4 checks passed
@DamianZaremba
DamianZaremba deleted the feature/add-basic-replication-break-glass branch August 31, 2026 16:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DamianZaremba