From d48bbff01dbdd20b69cb95847ee79ff6d70d9eb4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Wed, 9 Sep 2026 22:42:54 +0200
Subject: [PATCH] ci: take the dependency audit off pull requests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`pnpm audit --prod` answers a question about the published advisory database,
not about the diff. The same lockfile passes on Monday and fails on Tuesday
because someone else published, and the branch that turns red changed nothing:
seventeen of the forty-one Security & Quality failures in the last thirty days
were advisory publications on branches that touched no dependency
(GHSA-jqff-g426-hqxp, GHSA-fph4-wmhf-6fwf, GHSA-f65p-4m7j-42xc and
GHSA-5jgf-p345-68v8 in one run alone). A gate that fails for a reason the author
cannot act on is a gate people re-run instead of read.

It keeps running on every push to `main` and once a day on a new schedule
trigger, which is the cadence the question actually has. The other three jobs
sit out the scheduled run. Nothing about what ships is loosened: the container
scan still builds and scans the image on every push to `main`, and the daily
Trivy workflow still scans the lockfile with dev dependencies included and the
published image.

Gate — the trigger set, read back from the parsed workflow:

  triggers: push, pull_request, schedule
  quality          | if: github.event_name != 'schedule'
  dependency-audit | if: github.event_name != 'pull_request'
  secret-scan      | if: github.event_name != 'schedule'
  docker-security  | if: github.event_name == 'push' && github.ref == 'refs/heads/main'
---
 .github/workflows/security.yml | 19 +++++++++++++++++++
 .github/workflows/trivy.yml    |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 774f04be7..554e4c40e 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -5,6 +5,11 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  schedule:
+    # Daily, 05:47 UTC. Carries the dependency audit only — every other job
+    # here answers "is this change safe" and has nothing to say about a tree
+    # nobody touched. See the note on `dependency-audit`.
+    - cron: "47 5 * * *"
 
 permissions:
   contents: read
@@ -13,6 +18,7 @@ jobs:
   quality:
     name: Lint, Typecheck & Test
     runs-on: ubuntu-latest
+    if: github.event_name != 'schedule'
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -81,9 +87,21 @@ jobs:
           fi
           echo "::notice::OpenAPI spec in sync with Zod source schemas."
 
+  # Not on pull requests. `pnpm audit` answers a question about the published
+  # advisory database, not about the diff: the same lockfile passes on Monday
+  # and fails on Tuesday because someone else published, and the branch that
+  # goes red changed nothing. Seventeen of the forty-one failures this workflow
+  # produced in thirty days were exactly that, and a gate that fails for
+  # reasons the author cannot act on is a gate people learn to re-run rather
+  # than read. It runs on every push to `main` and once a day on the schedule
+  # above, which is the cadence the question actually has. What ships is still
+  # gated: `docker-security` scans the built image on every push to `main`, and
+  # `trivy.yml` scans the lockfile (dev dependencies included) and the
+  # published image daily.
   dependency-audit:
     name: Dependency Audit
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -109,6 +127,7 @@ jobs:
   secret-scan:
     name: Secret Scanning
     runs-on: ubuntu-latest
+    if: github.event_name != 'schedule'
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index dcc54336d..0bec8cd01 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -4,7 +4,7 @@ name: Trivy Scheduled Scan
 #
 # What already exists and is NOT repeated here:
 #   - `security.yml` → `dependency-audit` runs `pnpm audit --prod` on every
-#     push and pull request, blocking on HIGH/CRITICAL.
+#     push to `main` and once a day, blocking on HIGH/CRITICAL.
 #   - `security.yml` → `docker-security` builds the image on a push to `main`
 #     and runs `trivy image` against it, blocking on HIGH/CRITICAL.
 #