From de7c89a46228686868ef9cc0885c56d79d3e75aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Thu, 10 Sep 2026 00:20:30 +0200 Subject: [PATCH] ci: keep the dependency audit visible on pull requests without blocking them The audit had moved off the pull_request trigger entirely, which left a window in which a tag could be cut from a merge the audit had not seen. It runs on pull requests again as an advisory job (continue-on-error), stays blocking on the push run for main and on the daily schedule, and a tag is only ever cut from a green push run. --- .github/workflows/security.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 554e4c40e..ba9c50a56 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -101,7 +101,11 @@ jobs: dependency-audit: name: Dependency Audit runs-on: ubuntu-latest - if: github.event_name != 'pull_request' + # Runs on pull requests too, but advisory: an advisory published against a + # dependency the branch did not touch must not block the branch. The push + # run on main and the daily schedule stay blocking, and a tag is only ever + # cut from a main whose push run is green. + continue-on-error: ${{ github.event_name == 'pull_request' }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1