From ba23f719ab8910c532d65f3c2e3e011ff2ec40f9 Mon Sep 17 00:00:00 2001
From: Floweynt <floweydev@gmail.com>
Date: Fri, 11 Sep 2026 20:17:12 +0000
Subject: [PATCH 1/4] ci: fix vulnix GITHUB_OUTPUT format error

---
 ci.nix | 7 +++++++
 ci.py  | 5 +++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/ci.nix b/ci.nix
index 2a6d0d1..77fa121 100644
--- a/ci.nix
+++ b/ci.nix
@@ -1,10 +1,17 @@
 { lib, pkgs }:
+let
+  # vulnix's bundled nix-2.34 broke its own --experimental-features detection
+  nixConf = pkgs.writeText "ci-nix.conf" "experimental-features = nix-command flakes";
+in
 # tools must track ci.py's subprocess calls; nix stays ambient (uses the
 # runner's own nix, not a pinned one).
 pkgs.writers.writePython3Bin "ci" {
   flakeIgnore = [ "E501" ];
   libraries = [ pkgs.python3Packages.subprocess-tee ];
   makeWrapperArgs = [
+    "--set-default"
+    "NIX_USER_CONF_FILES"
+    (toString nixConf)
     "--prefix"
     "PATH"
     ":"
diff --git a/ci.py b/ci.py
index 7c47483..86eafef 100644
--- a/ci.py
+++ b/ci.py
@@ -18,7 +18,8 @@ def run(*args, **kw):
 
 
 def nix(*args):
-    return subprocess_tee.run(("nix", "--extra-experimental-features", "nix-command flakes", "-L", *args), check=True, text=True).stdout
+    # tee to stderr - stdout leaks into GITHUB_OUTPUT $() captures
+    return subprocess_tee.run(("nix", "--extra-experimental-features", "nix-command flakes", "-L", *args), check=True, text=True, stdout=sys.stderr).stdout
 
 
 def git(*args, check=True):
@@ -254,7 +255,7 @@ def format_vulnix(vulns):
 
 def vulnix(args):
     paths = list(build_hosts(args.ref).values())
-    result = run("vulnix", "-j", "-C", *paths, capture_output=True)
+    result = run("vulnix", "-j", *paths, capture_output=True)
     if result.returncode not in (0, 2):
         print(result.stderr, file=sys.stderr)
         sys.exit(result.returncode)
-- 
2.55.0


From feae5771086767c37a605750c5912cb05e8f17e8 Mon Sep 17 00:00:00 2001
From: Floweynt <floweydev@gmail.com>
Date: Fri, 11 Sep 2026 20:55:44 +0000
Subject: [PATCH 2/4] ci: log gitea API error responses

---
 ci.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/ci.py b/ci.py
index 86eafef..dca9269 100644
--- a/ci.py
+++ b/ci.py
@@ -33,8 +33,11 @@ def gitea(method, path, body=None):
     req.add_header("Authorization", f'token {os.environ["GH_TOKEN"]}')
     if data is not None:
         req.add_header("Content-Type", "application/json")
-    with urllib.request.urlopen(req) as resp:
-        raw = resp.read()
+    try:
+        with urllib.request.urlopen(req) as resp:
+            raw = resp.read()
+    except urllib.error.HTTPError as e:
+        sys.exit(f"gitea {method} {path}: {e.code} {e.reason}\n{e.read().decode()}")
     return json.loads(raw) if raw else None
 
 
-- 
2.55.0


From 4e8a8666b72820164022ddb66febf6da2e7682ec Mon Sep 17 00:00:00 2001
From: Floweynt <floweydev@gmail.com>
Date: Fri, 11 Sep 2026 21:24:49 +0000
Subject: [PATCH 3/4] ci: drop explicit permissions block from vulnix workflow

---
 .github/workflows/vulnix.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/workflows/vulnix.yml b/.github/workflows/vulnix.yml
index 60f797c..27f10a4 100644
--- a/.github/workflows/vulnix.yml
+++ b/.github/workflows/vulnix.yml
@@ -5,10 +5,6 @@ on:
     - cron: "0 6 * * 1"
   workflow_dispatch:
 
-permissions:
-  contents: read
-  issues: write
-
 jobs:
   scan:
     runs-on: nix
-- 
2.55.0


From b7f57b57e8366f21aae5475874e128d7079a6d65 Mon Sep 17 00:00:00 2001
From: Floweynt <floweydev@gmail.com>
Date: Sat, 12 Sep 2026 00:15:17 +0000
Subject: [PATCH 4/4] ci: exclude PRs from issue search, sanitize vulnix
 descriptions for markdown tables

---
 ci.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ci.py b/ci.py
index dca9269..61076ea 100644
--- a/ci.py
+++ b/ci.py
@@ -42,7 +42,7 @@ def gitea(method, path, body=None):
 
 
 def find_open_issue(label):
-    issues = gitea("GET", f"/issues?state=open&labels={label}")
+    issues = gitea("GET", f"/issues?state=open&type=issues&labels={label}")
     return issues[0] if issues else None
 
 
@@ -239,7 +239,7 @@ def format_vulnix(vulns):
     for v in vulns:
         for cve in v["affected_by"]:
             score = v.get("cvssv3_basescore", {}).get(cve)
-            desc = v.get("description", {}).get(cve, "")
+            desc = v.get("description", {}).get(cve, "").replace("\n", " ").replace("|", "∣")
             if len(desc) > 120:
                 desc = desc[:117] + "..."
             rows.append((v["pname"], v["version"], cve, score, desc))
-- 
2.55.0