security_watch: a GitHub Actions advisory is not listed; an empty fix with a closed range reads 'after X' (R-1310 part; test W9, red first)

scripts/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 2026-10-27 — the security watch reads two notice shapes right (R-1310, part)
+
+- **`security_watch.py` `ghsa_affects`:** a GitHub Actions advisory (ecosystem `actions`, the project's own CI) is no
+  longer listed against an image (Home Assistant's GHSA-jff5); an empty fixed version with a range that ENDS at a version
+  now reads „a version after X (the notice names none)" instead of „no fixed version named yet" (Vikunja's six, fixed in
+  2.7.0). Test W9 in `test_security_watch.py`, seen failing first (2 of 4 red, both controls green). The other shapes
+  R-1310 lists stay open.
+
 ## 2026-10-26 (night) — the nightly security watch (R-1303)
 
 - **`security_watch.py`** (new): every night (CI `.gitea/workflows/security-watch.yml`, 03:40 UTC) it reads GitHub's

scripts/security_watch.py

@@ -191,6 +191,11 @@ def ghsa_affects(adv, ours, repo=""):
         pkg = (vul.get("package") or {}).get("name") or ""
         if only and not only.search(pkg.strip()):
             continue
+        # A GitHub Actions advisory is about the project's own CI workflow, never the image we run (R-1310: Home
+        # Assistant's GHSA-jff5, 2023). Pinned: test W9.
+        if ((vul.get("package") or {}).get("ecosystem") or "").lower() == "actions":
+            verdicts.append(False)
+            continue
         r = range_affects(vul.get("vulnerable_version_range"), ours, pkg)
         p = patched_for(vul.get("patched_versions"), ours)
         if p is not None and vcmp(ours, p) >= 0 and r is not False:
@@ -200,7 +205,12 @@ def ghsa_affects(adv, ours, repo=""):
         verdicts.append(r)
         if r:
             pv = (vul.get("patched_versions") or "").strip()
-            fixed.append(pv if pv and pv.lower() not in ("none", "tbd", "n/a") else "no fixed version named yet")
+            if not pv or pv.lower() in ("none", "tbd", "n/a"):
+                # An empty fix with a range that ENDS at a version means „fixed after it" (R-1310: Vikunja's six,
+                # `>= 2.3.0, <= 2.6.0`, were fixed in 2.7.0 and read „no fix"). Pinned: test W9.
+                end = re.search(r"<=?\s*v?(\d+(?:\.\d+)+)\s*$", vul.get("vulnerable_version_range") or "")
+                pv = ("a version after %s (the notice names none)" % end.group(1)) if end else "no fixed version named yet"
+            fixed.append(pv)
     if any(v is True for v in verdicts):
         return True, ", ".join(sorted(set(fixed)))
     if not verdicts or all(v is False for v in verdicts):

scripts/test_security_watch.py

@@ -13,9 +13,11 @@ What is pinned, each by its consequence (the mail or the class), not by its mech
   W7  the weekly summary on Monday only (or when the last one is 8+ days old); a seed mails nothing and says what it
       would have mailed
   W8  the inventory: an image with no upstream line refuses (the gate), a gap needs a reason, the grammar
+  W9  a GitHub Actions advisory is not listed; an empty fix with a range ending at X reads „after X", not „no fix"
 Red-proofs (2026-10-26): W5 with the `k not in known` test removed (every night mails) -> W5 fails; W6 with the streak
 threshold at 1 -> W6 fails; W2 with FEED_DAYS check removed -> W2's old-item case fails; W4 with SourceError swallowed
--> W4 fails.
+-> W4 fails. W9 (2026-10-27, R-1310) was seen failing before its two rules existed (2 of 4 checks red, the two
+controls green).
 """
 import datetime
 import json
@@ -300,7 +302,29 @@ def t_inventory():
         shutil.rmtree(ws, ignore_errors=True)
 
 
+def t_ranges():
+    """W9 (R-1310, measured 2026-10-27): two shapes a hand read of all 38 flagged pins found wrong."""
+    print("-- W9: notices that are not about the product; an empty fix with a closed range")
+    ci = {"vulnerabilities": [{"package": {"ecosystem": "actions", "name": "home-assistant/actions/helpers/version"},
+                               "vulnerable_version_range": "< September 5, 2023", "patched_versions": "September 5, 2023"}]}
+    a, _ = w.ghsa_affects(ci, w.version_of("2026.9.4"), "home-assistant/core")
+    check("W9 a GitHub Actions advisory (the project's CI) is not about the image -> not listed", a is False, a)
+    prod = {"vulnerabilities": [{"package": {"ecosystem": "go", "name": "code.vikunja.io/api"},
+                                 "vulnerable_version_range": ">= 2.3.0, <= 2.6.0", "patched_versions": ""}]}
+    a, fixed = w.ghsa_affects(prod, w.version_of("2.6.0"), "go-vikunja/vikunja")
+    check("W9 an empty fix with a range ending at 2.6.0 -> ADVISORY, fixed after 2.6.0 (not 'no fixed version')",
+          a is True and "after 2.6.0" in fixed and "no fixed version" not in fixed, (a, fixed))
+    a, fixed = w.ghsa_affects(prod, w.version_of("2.7.0"), "go-vikunja/vikunja")
+    check("W9 negative: the same notice at 2.7.0 -> not listed", a is False, (a, fixed))
+    open_ = {"vulnerabilities": [{"package": {"ecosystem": "go", "name": "x"},
+                                  "vulnerable_version_range": ">= 2.3.0", "patched_versions": ""}]}
+    a, fixed = w.ghsa_affects(open_, w.version_of("2.6.0"), "o/r")
+    check("W9 control: an open range with no fix still says 'no fixed version named yet'",
+          a is True and fixed == "no fixed version named yet", (a, fixed))
+
+
 def main():
+    t_ranges()
     t_classes()
     t_memory()
     t_inventory()