From 8633fe41834921461c73ba027f24ececbb656424 Mon Sep 17 00:00:00 2001 From: t Date: Tue, 15 Sep 2026 23:15:17 +0530 Subject: [PATCH] Audit dependencies on every pull request, not only those targeting master `dependency-security.yml` carried the same `pull_request: branches: [master]` filter #398 removed from `ci.yml`, so a pull request stacked on another branch got no `cargo-audit` or frontend dependency audit at all. It still reported a green mergeable state, because nothing required had failed -- the same shape of false green, in the workflow whose whole job is to tell you about an advisory. The cost of the gap is different from `ci.yml`'s, which is why it is worth fixing separately rather than living with. A missing test run delays a signal about code the PR contains. A missing dependency audit delays a signal about a published advisory that may already apply, and the delay lasts until the stack root merges -- so the advisory surfaces attached to whichever PR happens to land first, not to the one that introduced the dependency. `push` stays master-only for the reason `ci.yml` gives: a branch worth auditing has a pull request, and that is what triggers the run. `dependency-security.yml` is in the compatibility surface, so surface and matrix are resealed: one hash changed, pin set unchanged at 212 (set-compared against master, not counted), and the recorded sha256 matches the file's bytes. Verified with every exit status read directly: `reseal.sh --verify` exit 0; `check-ci-workflow-consistency.mjs` exit 0; compatibility gate passes; tools workspace 11 binaries, 53 passed, 0 failed. The workflow parses and keeps its single `audit` job, with `pull_request` now carrying only `types`. Co-Authored-By: Claude Opus 5 --- .github/workflows/dependency-security.yml | 8 +++++++- docs/tally/compatibility/compatibility-matrix.json | 2 +- docs/tally/compatibility/compatibility-surface.json | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependency-security.yml b/.github/workflows/dependency-security.yml index fb99ca1b..9fba20b8 100644 --- a/.github/workflows/dependency-security.yml +++ b/.github/workflows/dependency-security.yml @@ -2,9 +2,15 @@ name: Dependency Security on: push: + # Only master, for the reason ci.yml gives: a branch worth auditing has a + # pull request, and that is what triggers below. branches: [master] pull_request: - branches: [master] + # Unfiltered by base branch, matching ci.yml. Filtering to `[master]` left + # a pull request stacked on another branch with no audit at all until its + # root merged -- and a PR with no audit still reports a green mergeable + # state, because nothing required failed. A dependency advisory is worth + # hearing about on the PR that introduces it, not several PRs later. types: [opened, reopened, synchronize, ready_for_review] workflow_dispatch: diff --git a/docs/tally/compatibility/compatibility-matrix.json b/docs/tally/compatibility/compatibility-matrix.json index 6ddba8ad..3273e529 100644 --- a/docs/tally/compatibility/compatibility-matrix.json +++ b/docs/tally/compatibility/compatibility-matrix.json @@ -1,7 +1,7 @@ { "schema_version": 1, "bridge_commit_sha": "be1c20cc3fd66fa1ece196505c69f26e555e4b8e", - "compatibility_surface_sha256": "b0a658a972bd150599add28b408fddf5026c3dc67a105e49f7256ca7ada255ad", + "compatibility_surface_sha256": "ad4e2866217ec8778d76a3eb50c951b892d47bd9f786f38cfd3bd1e07e72bd95", "claims": [ { "claim_id": "erp9-6-6-3-windows-education-xml-one-company", diff --git a/docs/tally/compatibility/compatibility-surface.json b/docs/tally/compatibility/compatibility-surface.json index 078e04a0..037a1b20 100644 --- a/docs/tally/compatibility/compatibility-surface.json +++ b/docs/tally/compatibility/compatibility-surface.json @@ -7,7 +7,7 @@ }, { "path": ".github/workflows/dependency-security.yml", - "sha256": "3c014174f82b5935c97ae5d228f1c2ee71e03f00c327d667df1ca4ff27cf75f4" + "sha256": "fd70b9a317677100d6b760a369495f9e3c6a083d7cdbf8f1916267d97eaa250f" }, { "path": "docs/adr/0004-tally-write-safety.md", @@ -850,5 +850,5 @@ "sha256": "a8ac2714fecf51947f2822c8c46d7ce2e8602c732780ff60566a7771f0836f9a" } ], - "manifest_sha256": "b0a658a972bd150599add28b408fddf5026c3dc67a105e49f7256ca7ada255ad" + "manifest_sha256": "ad4e2866217ec8778d76a3eb50c951b892d47bd9f786f38cfd3bd1e07e72bd95" } \ No newline at end of file