fix(ci): harden CI against rubber-stamping (PRs to develop, continue-on-error, codecov, root-config paths)

.github/actions/rust-ci/action.yml

@@ -126,7 +126,29 @@ runs:
       uses: taiki-e/install-action@cargo-audit
 
     - name: Audit dependencies
+      # cargo audit exits 1 on ANY advisory. Keep non-blocking here; the
+      # follow-up step fails only when a NEW (un-ignored) advisory is found
+      # that is not already documented in security/risk-register.yaml.
       continue-on-error: true
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      run: cargo audit
+      run: cargo audit --json > /tmp/cargo-audit.json 2>/dev/null || true
+
+    - name: Check for new Rust advisories
+      # Run on success or failure of the audit step, but not on cancel.
+      # Use --min-severity high for cargo to catch DoS-class advisories
+      # (RUSTSEC-2026-0194/0195 in quick-xml are severity "high"); the
+      # script handles missing/empty/malformed JSON and missing risk
+      # register gracefully (exits 0 with a warning in both cases).
+      # Resolve the script via $GITHUB_WORKSPACE because this composite
+      # action is invoked with working-directory set to a sub-crate
+      # (cli/, desktop/src-tauri/, libraries/droplet/), where a relative
+      # `scripts/check-new-vulns.cjs` would not exist.
+      if: success() || failure()
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: |
+        node "$GITHUB_WORKSPACE/scripts/check-new-vulns.cjs" \
+          --format cargo \
+          --json /tmp/cargo-audit.json \
+          --min-severity high

.github/codecov.yml

@@ -0,0 +1,36 @@
+# Codecov configuration for Drop monorepo.
+# Current baseline: 29.32% line coverage (server backend).
+# Thresholds are intentionally informational until coverage crosses 50% —
+# flipping to blocking now would block PRs on coverage infrastructure noise.
+# Re-evaluate when server coverage > 50% (track in dedicated issue).
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 2%
+        base: auto
+        informational: true
+    patch:
+      default:
+        target: 80%
+        informational: true
+flag_management:
+  default_rules:
+    carryforward: true
+    statuses:
+      - type: project
+        target: auto
+        threshold: 2%
+        informational: true
+      - type: patch
+        target: 80%
+        informational: true
+  individual_flags:
+    - name: server
+      paths:
+        - server/
+      carryforward: true
+comment:
+  layout: "diff, flags, files"
+  behavior: default

.github/workflows/ci.yml

@@ -9,6 +9,7 @@ on:
     branches:
       - main
       - rebuild
+      - develop
 
 permissions:
   contents: read
@@ -96,6 +97,19 @@ jobs:
         # Remove ignore when upstream publishes decompress@>=4.2.2.
         continue-on-error: true
         run: pnpm audit --audit-level=critical --ignore GHSA-mp2f-45pm-3cg9
+
+      - name: Check for new critical advisories
+        # Run on success or failure of the audit step, but not on cancel.
+        # Use --min-severity critical for pnpm to limit noise; the script
+        # handles missing/empty/malformed JSON gracefully.
+        if: success() || failure()
+        run: |
+          pnpm audit --audit-level=critical --json > /tmp/audit.json 2>/dev/null || true
+          node scripts/check-new-vulns.cjs \
+            --format pnpm \
+            --json /tmp/audit.json \
+            --ignored GHSA-mp2f-45pm-3cg9 \
+            --min-severity critical
       - name: Typecheck
         working-directory: server
         run: pnpm run typecheck
@@ -174,7 +188,14 @@ jobs:
           fail_ci_if_error: false
           flags: server
       - name: Post coverage gaps to PR
+        # Skip silently when CODECOV_TOKEN is unset — the script fails
+        # Only run on PRs (script posts a comment); wrap with || true so a
+        # missing or invalid CODECOV_TOKEN does not fail the workflow.
+        # Step-level env is not visible in this step's own `if:` context
+        # so we cannot gate on env.CODECOV_TOKEN here; rely on the script
+        # being tolerant instead.
         if: github.event_name == 'pull_request'
+        continue-on-error: true
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -217,7 +238,6 @@ jobs:
           restore-keys: ${{ runner.os }}-sonar
       - name: SonarQube Scan
         id: sonar-scan
-        continue-on-error: true
         uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -244,7 +264,11 @@ jobs:
     name: SonarCloud PR Comment
     runs-on: ubuntu-latest
     needs: sonar
-    if: github.event_name == 'pull_request'
+    # Only run when the scan succeeded — otherwise the API has no findings
+    # to comment on and the script would post a confusing empty/errored
+    # comment. Branch protection enforces SonarCloud Scan as required, so
+    # a scan failure correctly blocks the merge regardless.
+    if: github.event_name == 'pull_request' && needs.sonar.result == 'success'
     permissions:
       contents: read
       pull-requests: write

.github/workflows/cli-ci.yml

@@ -6,11 +6,15 @@ on:
     paths:
       - "cli/**"
       - ".github/workflows/cli-ci.yml"
+      - "pnpm-workspace.yaml"
+      - "package.json"
   pull_request:
-    branches: [rebuild]
+    branches: [rebuild, develop]
     paths:
       - "cli/**"
       - ".github/workflows/cli-ci.yml"
+      - "pnpm-workspace.yaml"
+      - "package.json"
   workflow_dispatch:
 
 permissions:

.github/workflows/codeql.yml

@@ -15,7 +15,7 @@ on:
   push:
     branches: ["rebuild"]
   pull_request:
-    branches: ["rebuild"]
+    branches: ["rebuild", "develop"]
   schedule:
     - cron: "39 17 * * 0"
 

.github/workflows/desktop-ci.yml

@@ -6,11 +6,15 @@ on:
     paths:
       - "desktop/src-tauri/**"
       - ".github/workflows/desktop-ci.yml"
+      - "pnpm-workspace.yaml"
+      - "package.json"
   pull_request:
-    branches: [rebuild]
+    branches: [rebuild, develop]
     paths:
       - "desktop/src-tauri/**"
       - ".github/workflows/desktop-ci.yml"
+      - "pnpm-workspace.yaml"
+      - "package.json"
   workflow_dispatch:
 
 permissions:

.github/workflows/droplet-ci.yml

@@ -8,13 +8,17 @@ on:
       - "libraries/droplet_types/**"
       - "libraries/libarchive/**"
       - ".github/workflows/droplet-ci.yml"
+      - "pnpm-workspace.yaml"
+      - "package.json"
   pull_request:
-    branches: [rebuild]
+    branches: [rebuild, develop]
     paths:
       - "libraries/droplet/**"
       - "libraries/droplet_types/**"
       - "libraries/libarchive/**"
       - ".github/workflows/droplet-ci.yml"
+      - "pnpm-workspace.yaml"
+      - "package.json"
   workflow_dispatch:
 
 jobs:

.github/workflows/e2e.yml

@@ -11,7 +11,7 @@ on:
       - "pnpm-lock.yaml"
       - "pnpm-workspace.yaml"
   pull_request:
-    branches: [rebuild]
+    branches: [rebuild, develop]
     paths:
       - "server/**"
       - ".github/workflows/e2e.yml"

.github/workflows/editorconfig-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [rebuild]
   pull_request:
-    branches: [rebuild]
+    branches: [rebuild, develop]
   workflow_dispatch:
 
 permissions:

.github/workflows/open-code-review.yml

@@ -2,7 +2,7 @@ name: OpenCodeReview PR Review
 
 on:
   pull_request:
-    branches: [main, rebuild]
+    branches: [main, rebuild, develop]
     types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:

.github/workflows/osv-scanner.yml

@@ -1,10 +1,16 @@
 name: OSV-Scanner
 
+# Cancel outdated in-progress runs of the same workflow on the same PR
+# when a new commit is pushed. Avoids redundant scans and stale SARIF uploads.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
-    branches: ["rebuild"]
+    branches: ["rebuild", "develop"]
   merge_group:
-    branches: ["rebuild"]
+    branches: ["rebuild", "develop"]
   schedule:
     - cron: "26 14 * * 5"
   push:
@@ -28,6 +34,10 @@ jobs:
           persist-credentials: false
 
       - name: Run OSV-Scanner
+        # OSV scanner exits 1 on ANY CVE in the dependency tree (including transitive).
+        # We keep continue-on-error: true because blocking on transitive vulns would
+        # create constant noise. SARIF results are still uploaded below for review
+        # and the scan-pr job on pull_request events catches direct deps separately.
         continue-on-error: true
         uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
         with:

.github/workflows/server-ci.yml

@@ -11,7 +11,7 @@ on:
       - "pnpm-workspace.yaml"
       - ".github/workflows/server-ci.yml"
   pull_request:
-    branches: [rebuild]
+    branches: [rebuild, develop]
     paths:
       - "server/**"
       - "libraries/base/**"