Skip to content

ci(security): remove duplicate dependency review workflow #1539

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
seonghobae wants to merge 5 commits into
base: develop
Choose a base branch
from
Draft

ci(security): remove duplicate dependency review workflow #1539

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6e7a8d8
ci(workflows): use central reusable dependency-review.yml
seonghobae Sep 2, 2026
f5d9484
ci(dependency-review): add missing permissions block, fix stale local-
seonghobae Sep 3, 2026
72354c6
fix(ci): label reusable workflow provenance
seonghobae Sep 3, 2026
7bd59da
test(governance): assert dependency-review caller config structurally
seonghobae Sep 3, 2026
acd8a84
ci(security): remove duplicate dependency review workflow
seonghobae Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 0 additions & 50 deletions .github/workflows/dependency-review.yml
View file
Open in desktop

This file was deleted.

34 changes: 8 additions & 26 deletions backend/tests/test_release_governance.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -401,32 +401,6 @@ def test_stepsecurity_remediation_adds_pinned_audit_hardening() -> None:
assert "egress-policy: block" in mail_smoke_workflow
assert "allowed-endpoints:" in mail_smoke_workflow

dependency_review_workflow = read_repo_text(
".github/workflows/dependency-review.yml"
)
assert (
"actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0"
in dependency_review_workflow
)
assert "BASE_REF: ${{ github.base_ref || github.ref_name }}" in (
dependency_review_workflow
)
assert "HEAD_REF: ${{ github.head_ref || github.ref_name }}" in (
dependency_review_workflow
)
log_dependency_review_step = dependency_review_workflow.split(
"- name: Log dependency review policy", 1
)[1].split("- name: Review dependency changes", 1)[0]
log_dependency_review_script = log_dependency_review_step.split("run: |", 1)[1]
assert "${{ github.base_ref || github.ref_name }}" not in (
log_dependency_review_script
)
assert "${{ github.head_ref || github.ref_name }}" not in (
log_dependency_review_script
)
assert "printf 'Base ref: %s\\n' \"$BASE_REF\"" in log_dependency_review_script
assert "printf 'Head ref: %s\\n' \"$HEAD_REF\"" in log_dependency_review_script

pre_commit = read_repo_text(".pre-commit-config.yaml")
assert "https://github.com/gitleaks/gitleaks" in pre_commit
assert "rev: v8.16.3" in pre_commit
Expand All @@ -440,6 +414,14 @@ def test_stepsecurity_remediation_adds_pinned_audit_hardening() -> None:
assert "rev: v2.17.2" in pre_commit


def test_dependency_review_is_owned_by_the_central_required_workflow() -> None:
assert not (WORKFLOW_DIR / "dependency-review.yml").exists()

agent_guidance = read_repo_text("AGENTS.md")
assert "central **Security Scan** required gate" in agent_guidance
assert "`dependency-review` (diff-scoped)" in agent_guidance


def test_actionlint_recognizes_the_mail_egress_runner_label() -> None:
actionlint_config = read_repo_text(".github/actionlint.yaml")

Expand Down
Loading