Fail a pull request for the advisories it introduces, not the world's

.github/workflows/dependency-security.yml

@@ -30,6 +30,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          # The differential step below resolves a merge base against the pull
+          # request's own base branch. The default shallow clone has no merge
+          # base to find, and fetching only the PR ref would not bring the base
+          # branch with it.
+          fetch-depth: 0
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
@@ -42,3 +47,22 @@ jobs:
           fallback: none
       - name: Audit locked Rust dependencies
         run: cargo audit --file src-tauri/Cargo.lock
+      # Deliberately additional, not a replacement. The step above answers "does
+      # this lockfile contain an accepted-severity advisory" and must keep
+      # failing when it does, whoever introduced it. This one answers the
+      # different question "did THIS pull request introduce one", which is the
+      # question a pull request's author can actually act on.
+      #
+      # On 2026-09-15 `RUSTSEC-2026-0285` was published against `rustls`, and
+      # the step above went red on an unchanged master, turning all nine then
+      # open pull requests red at once -- including ones touching neither
+      # rustls nor reqwest. Keeping both steps means that event still blocks
+      # master, while a pull request that introduced nothing is told so by name.
+      #
+      # Pull requests only: a `push: master` run has no other side to diff
+      # against. The script resolves its base from GITHUB_BASE_REF first, so a
+      # pull request stacked on a non-master branch diffs against that branch
+      # rather than against master.
+      - name: Fail only on advisories this pull request introduces
+        if: github.event_name == 'pull_request'
+        run: node scripts/check-advisory-delta.mjs

docs/tally/compatibility/compatibility-matrix.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "bridge_commit_sha": "be1c20cc3fd66fa1ece196505c69f26e555e4b8e",
-  "compatibility_surface_sha256": "f610a58ad2bb994388a4848b96cf789f2be536b715f82a74712ab677193f8e88",
+  "compatibility_surface_sha256": "5b64daf34962d8d3773aee88fe55cf317473df2b8443a0279387c4e7731802ed",
   "claims": [
     {
       "claim_id": "erp9-6-6-3-windows-education-xml-one-company",

docs/tally/compatibility/compatibility-surface.json

@@ -7,7 +7,7 @@
     },
     {
       "path": ".github/workflows/dependency-security.yml",
-      "sha256": "fd70b9a317677100d6b760a369495f9e3c6a083d7cdbf8f1916267d97eaa250f"
+      "sha256": "4f5420aeeeddf9326aad5b3d671468d292a10ca8466fa43125c7f7b735a41282"
     },
     {
       "path": "docs/adr/0004-tally-write-safety.md",
@@ -850,5 +850,5 @@
       "sha256": "a8ac2714fecf51947f2822c8c46d7ce2e8602c732780ff60566a7771f0836f9a"
     }
   ],
-  "manifest_sha256": "f610a58ad2bb994388a4848b96cf789f2be536b715f82a74712ab677193f8e88"
+  "manifest_sha256": "5b64daf34962d8d3773aee88fe55cf317473df2b8443a0279387c4e7731802ed"
 }