ci(security): use central dependency review

.github/workflows/build-ci-image.yml

@@ -7,6 +7,7 @@ on:
       - 'Dockerfile.test'
       - '.github/workflows/build-ci-image.yml'
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
     paths:
       - 'Dockerfile.test'
       - '.github/workflows/build-ci-image.yml'
@@ -16,8 +17,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-and-push:
+    if: github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false)
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -42,7 +48,7 @@ jobs:
       - name: Lowercase repository owner
         id: lowercase_owner
         run: |
-          echo "owner=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_OUTPUT
+          echo "owner=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_OUTPUT"
 
       - name: Extract metadata for Docker
         id: meta

.github/workflows/clusterfuzzlite.yml

@@ -2,13 +2,19 @@ name: clusterfuzzlite
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
   workflow_dispatch:
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   fuzz:
+    if: github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false)
     runs-on: ubuntu-latest
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

.github/workflows/codeql.yml

@@ -3,7 +3,6 @@ name: codeql
 on:
   push:
     branches: [main, develop]
-  pull_request:
   schedule:
     - cron: '43 5 * * 1'
 

.github/workflows/container-image.yml

@@ -2,6 +2,7 @@ name: container-image
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
   push:
     tags:
       - 'v*'
@@ -15,8 +16,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   image:
+    if: github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false)
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/dependency-review.yml

@@ -2,22 +2,20 @@ name: dependency-review
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
   pull-requests: read
 
 jobs:
   dependency-review:
-    name: dependency-review
-    runs-on: ubuntu-latest
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
-
-      - name: Dependency review
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294
-        with:
-          allow-ghsas: "GHSA-69w3-r845-3855"
+    if: ${{ github.event.action != 'closed' && github.event.pull_request.draft == false }}
+    uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@f43dcb884be5a0efc61611b5c8cb83c4c7735995
+    with:
+      fail_on_severity: low
+      allow_ghsas: "GHSA-69w3-r845-3855"

.github/workflows/quality-gate.yml

@@ -4,12 +4,18 @@ on:
   push:
     branches: [main, develop]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   quality-gate:
+    if: github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false)
     name: quality-gate
     runs-on: ubuntu-latest
     env:

.github/workflows/scorecards.yml

@@ -3,7 +3,6 @@ name: scorecards
 on:
   push:
     branches: [develop]
-  pull_request:
   schedule:
     - cron: '31 5 * * 1'
 

.github/workflows/tests.yml

@@ -4,13 +4,19 @@ on:
   push:
     branches: [main, develop]
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
 
 permissions:
   contents: read
   packages: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   pytest:
+    if: github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false)
     runs-on: ubuntu-latest
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -35,4 +41,4 @@ jobs:
         env:
           PYTHONWARNINGS: error
           PYTHONPATH: src
-        run: uv run pytest --cov=src/newsdom_api --cov-branch --cov-report=term-missing --cov-fail-under=100
+        run: uv run pytest --cov=src/newsdom_api --cov-branch --cov-report=term-missing --cov-fail-under=100

tests/test_workflow_runtime_env.py

@@ -1,3 +1,4 @@
+import re
 from pathlib import Path
 
 import yaml
@@ -15,6 +16,12 @@ def test_each_workflow_job_forces_javascript_actions_to_node24():
         for job_name, job_data in data["jobs"].items():
             if workflow_path.name in {"scorecards.yml", "gh-pages.yml"}:
                 continue
+            if "uses" in job_data:
+                assert re.search(r"@[0-9a-f]{40}$", job_data["uses"]), (
+                    workflow_path,
+                    job_name,
+                )
+                continue
             assert job_data["env"]["FORCE_JAVASCRIPT_ACTIONS_TO_NODE24"] is True, (
                 workflow_path,
                 job_name,

tests/test_workflow_security.py

@@ -91,6 +91,50 @@ def test_ci_workflows_run_for_all_pull_requests():
         )
 
 
+def test_pull_request_workflows_cancel_only_superseded_ready_heads():
+    for workflow_path in _iter_workflow_paths():
+        workflow = yaml.safe_load(workflow_path.read_text(encoding="utf-8"))
+        triggers = workflow.get("on", workflow.get(True))
+        if "pull_request" not in triggers:
+            continue
+
+        pull_request = triggers["pull_request"] or {}
+        assert {
+            "opened",
+            "synchronize",
+            "reopened",
+            "ready_for_review",
+            "converted_to_draft",
+            "closed",
+        } <= set(pull_request["types"]), workflow_path
+        concurrency = workflow["concurrency"]
+        assert "${{ github.workflow }}-${{ github.repository }}-" in concurrency[
+            "group"
+        ], workflow_path
+        assert concurrency["cancel-in-progress"] in {
+            True,
+            "${{ github.event_name == 'pull_request' }}",
+        }, workflow_path
+
+        for job in workflow["jobs"].values():
+            condition = str(job.get("if", ""))
+            if "github.event_name == 'workflow_dispatch'" in condition:
+                continue
+            assert "github.event.action != 'closed'" in condition, workflow_path
+            assert (
+                "github.event.pull_request.draft == false" in condition
+            ), workflow_path
+
+
+def test_central_security_owners_replace_local_pr_triggers():
+    for workflow_name in ("codeql.yml", "scorecards.yml"):
+        workflow = yaml.safe_load(
+            Path(".github/workflows", workflow_name).read_text(encoding="utf-8")
+        )
+        triggers = workflow.get("on", workflow.get(True))
+        assert "pull_request" not in triggers, workflow_name
+
+
 def test_docs_workflow_uses_least_privilege_pages_permissions():
     text = Path(".github/workflows/gh-pages.yml").read_text(encoding="utf-8")
     assert "contents: write" not in text