From 9fa7541e2c2e8bb9f0aa0f04c3cbed720c8e5dd0 Mon Sep 17 00:00:00 2001
From: liamadale <liamalexanderdale@gmail.com>
Date: Wed, 15 Apr 2026 13:31:12 -0700
Subject: [PATCH 1/2] fix: handle missing ticket data files gracefully in CI

_load() now returns empty list when data files are absent (same as
_load_optional), preventing FileNotFoundError in CI where runtime
data/tickets/indexed/ files are gitignored.
---
 apps/mantis_web/data.py  | 5 ++++-
 mcp/enrichment/server.py | 1 +
 mcp/mantis/server.py     | 1 +
 mcp/opensearch/server.py | 1 +
 4 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/apps/mantis_web/data.py b/apps/mantis_web/data.py
index ad88b1d..0d10de5 100644
--- a/apps/mantis_web/data.py
+++ b/apps/mantis_web/data.py
@@ -12,7 +12,10 @@
 
 
 def _load(name: str) -> list:
-    with open(os.path.join(DATA_DIR, name), encoding="utf-8") as f:
+    path = os.path.join(DATA_DIR, name)
+    if not os.path.exists(path):
+        return []
+    with open(path, encoding="utf-8") as f:
         return json.load(f)
 
 
diff --git a/mcp/enrichment/server.py b/mcp/enrichment/server.py
index ae36cb0..65bc79b 100644
--- a/mcp/enrichment/server.py
+++ b/mcp/enrichment/server.py
@@ -31,6 +31,7 @@
 setup_dns()
 
 from mcp.server.fastmcp import FastMCP
+
 from src.enricher import abuseipdb, greynoise, shodan, virustotal
 from src.enricher.threat_intel import enrich_ip as _enrich_ip
 from src.utils.ip_org import lookup_org
diff --git a/mcp/mantis/server.py b/mcp/mantis/server.py
index d76c2cd..71a35ae 100644
--- a/mcp/mantis/server.py
+++ b/mcp/mantis/server.py
@@ -35,6 +35,7 @@
 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
 from mcp.server.fastmcp import FastMCP
+
 from src.mantis.mantis_search import search
 
 mcp = FastMCP("mantis")
diff --git a/mcp/opensearch/server.py b/mcp/opensearch/server.py
index a69dfa7..33d013c 100644
--- a/mcp/opensearch/server.py
+++ b/mcp/opensearch/server.py
@@ -34,6 +34,7 @@
 setup_dns()
 
 from mcp.server.fastmcp import FastMCP
+
 from src.enricher.threat_intel import enrich_ip
 from src.querier.fp_manager import (
     append_clauses_to_file,

From bf94c0c0c7b7174a059a88dacdd67d4cf529ba16 Mon Sep 17 00:00:00 2001
From: liamadale <liamalexanderdale@gmail.com>
Date: Wed, 15 Apr 2026 13:56:02 -0700
Subject: [PATCH 2/2] fix: use dereferenced commit SHAs for pinned actions

Annotated tag SHAs don't pass scorecard's workflow verification.
Use the actual commit SHAs instead.
---
 .github/workflows/ci.yml        | 2 +-
 .github/workflows/codeql.yml    | 4 ++--
 .github/workflows/scorecard.yml | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f7840a..ba49fd0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 47ce428..24efa26 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,8 +19,8 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: github/codeql-action/init@865f5f5c36632f18690a3d569fa0a764f2da0c3e # v3
+      - uses: github/codeql-action/init@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
         with:
           languages: python
 
-      - uses: github/codeql-action/analyze@865f5f5c36632f18690a3d569fa0a764f2da0c3e # v3
+      - uses: github/codeql-action/analyze@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 736e7c0..6c4718f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -19,12 +19,12 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: ossf/scorecard-action@ff5dd8929f96a8a4dc67d13f32b8c75057829621 # v2.4.0
+      - uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
 
-      - uses: github/codeql-action/upload-sarif@865f5f5c36632f18690a3d569fa0a764f2da0c3e # v3
+      - uses: github/codeql-action/upload-sarif@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a # v3
         with:
           sarif_file: results.sarif