From 3841cca6940dc1d1dc3c6d1babf21a017278713a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 19:57:43 +0900 Subject: [PATCH 1/8] ci(workflows): use central reusable dependency-review.yml Replace this repo's hand-written dependency-review.yml (with its own dynamic dependency-graph-availability preflight) with a thin caller into ContextualWisdomLab/.github's new workflow_call workflow, which generalizes this repo's own preflight design (the most robust of the four originals) to every caller. Preserves this repo's exact original policy: fail-on-severity: moderate, comment-summary-in-pr: on-failure (now applied uniformly in the central workflow), and the pull_request-only event guard (now handled inside the reusable workflow's own preflight step, so no job-level if: is needed here). See ContextualWisdomLab/.github#1724 and its docs/adr/0024-.../ docs/doctoring/dependency-review-reusable-workflow-consolidation.md for the full audit and design rationale. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/dependency-review.yml | 63 ++----------------------- 1 file changed, 3 insertions(+), 60 deletions(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 6795d40e..81882e42 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -4,69 +4,12 @@ on: pull_request: workflow_dispatch: -permissions: - contents: read - pull-requests: read - concurrency: group: dependency-review-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true jobs: dependency-review: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - persist-credentials: false - - - name: Check dependency review support - id: dependency_review_support - env: - GH_TOKEN: ${{ github.token }} - BASE_SHA: ${{ github.event.pull_request.base.sha }} - HEAD_SHA: ${{ github.event.pull_request.head.sha }} - REPOSITORY: ${{ github.repository }} - shell: bash - run: | - set -euo pipefail - - if [ "${{ github.event_name }}" != "pull_request" ]; then - echo "supported=false" >>"$GITHUB_OUTPUT" - echo "Dependency review only runs as a hard gate for pull_request events." - exit 0 - fi - - api_url="${GITHUB_API_URL:-https://api.github.com}" - response_file="$(mktemp)" - status="$( - curl -fsS -o "$response_file" -w '%{http_code}' \ - -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer ${GH_TOKEN}" \ - -H "X-GitHub-Api-Version: 2022-11-28" \ - "${api_url}/repos/${REPOSITORY}/dependency-graph/compare/${BASE_SHA}...${HEAD_SHA}" \ - || true - )" - - if [ "$status" = "200" ]; then - echo "supported=true" >>"$GITHUB_OUTPUT" - exit 0 - fi - - if [ "$status" = "403" ] || [ "$status" = "404" ]; then - echo "::warning::Dependency review is unavailable for ${REPOSITORY}; skipping dependency-review hard gate." - echo "supported=false" >>"$GITHUB_OUTPUT" - exit 0 - fi - - echo "::error::Dependency review support check failed with HTTP ${status}." - cat "$response_file" - exit 1 - - - name: Dependency review - if: steps.dependency_review_support.outputs.supported == 'true' - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 - with: - fail-on-severity: moderate - comment-summary-in-pr: on-failure + uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@main + with: + fail_on_severity: moderate From a4838e869020887d45b2f740549fbe0c57c228b1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:06:14 +0900 Subject: [PATCH 2/8] test(ci): require immutable central dependency-review workflow --- tests/config/test_strix_static_repo_adaptations.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/tests/config/test_strix_static_repo_adaptations.py b/tests/config/test_strix_static_repo_adaptations.py index 5707b278..41127922 100644 --- a/tests/config/test_strix_static_repo_adaptations.py +++ b/tests/config/test_strix_static_repo_adaptations.py @@ -8,6 +8,7 @@ OSV_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "osvscanner.yml" K8S_DEPLOYMENT = REPO_ROOT / "infra" / "k8s" / "deployment.yaml" K8S_SERVICE = REPO_ROOT / "infra" / "k8s" / "service.yaml" +CENTRAL_DEPENDENCY_REVIEW_WORKFLOW_SHA = "0bcd22d8bb07650aafb0a8f116e4c2bbb8744f03" def test_central_review_workflows_are_not_copied_into_this_repository() -> None: @@ -56,11 +57,17 @@ def test_kubernetes_deployment_uses_non_root_versioned_runtime() -> None: assert 'targetPort: 8080' in service_source -def test_companion_workflows_cover_named_requirements_manifests_and_full_history() -> None: +def test_companion_workflows_pin_central_dependency_review_and_cover_osv_manifests() -> None: dependency_review_source = DEPENDENCY_REVIEW_WORKFLOW.read_text(encoding="utf-8") osv_source = OSV_WORKFLOW.read_text(encoding="utf-8") - assert "actions/dependency-review-action@" in dependency_review_source + expected_reusable_workflow = ( + "ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@" + f"{CENTRAL_DEPENDENCY_REVIEW_WORKFLOW_SHA}" + ) + assert expected_reusable_workflow in dependency_review_source + assert "dependency-review.yml@main" not in dependency_review_source + assert "fail_on_severity: moderate" in dependency_review_source assert 'requirements(-[A-Za-z0-9._-]+)?\\.txt' in osv_source assert "google/osv-scanner-action" in osv_source assert "-r" in osv_source From 6fa119fca108af85a71fc7c15de9a15c111e5b1c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:06:26 +0900 Subject: [PATCH 3/8] fix(ci): pin reusable dependency review to protected source --- .github/workflows/dependency-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 81882e42..6b7adc98 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -10,6 +10,6 @@ concurrency: jobs: dependency-review: - uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@main + uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@0bcd22d8bb07650aafb0a8f116e4c2bbb8744f03 with: fail_on_severity: moderate From d99b182e2c6dc387fa9831655ad01de86b6996d0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:16:27 +0900 Subject: [PATCH 4/8] test(ci): preserve caller token permissions for reusable review --- tests/config/test_strix_static_repo_adaptations.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/config/test_strix_static_repo_adaptations.py b/tests/config/test_strix_static_repo_adaptations.py index 41127922..171bfb97 100644 --- a/tests/config/test_strix_static_repo_adaptations.py +++ b/tests/config/test_strix_static_repo_adaptations.py @@ -67,6 +67,7 @@ def test_companion_workflows_pin_central_dependency_review_and_cover_osv_manifes ) assert expected_reusable_workflow in dependency_review_source assert "dependency-review.yml@main" not in dependency_review_source + assert "permissions:\n contents: read\n pull-requests: read" in dependency_review_source assert "fail_on_severity: moderate" in dependency_review_source assert 'requirements(-[A-Za-z0-9._-]+)?\\.txt' in osv_source assert "google/osv-scanner-action" in osv_source From db8b8ed6d36a6dc6cc1d07255a7a9a86bc88bf4f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 20:16:35 +0900 Subject: [PATCH 5/8] fix(ci): retain caller permissions for reusable dependency review --- .github/workflows/dependency-review.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 6b7adc98..8f7015e6 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -4,6 +4,10 @@ on: pull_request: workflow_dispatch: +permissions: + contents: read + pull-requests: read + concurrency: group: dependency-review-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true From 4369f50ee8793223bd8ee0b228ff80c69931394a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 21:39:10 +0900 Subject: [PATCH 6/8] ci(workflows): re-pin to the SHA with harden-runner + comment_summary_in_pr A peer session's org-wide survey found naruon independently carrying its own dependency-review.yml with a harden-runner egress-audit step this consolidation's original four callers lacked. That step (and the comment_summary_in_pr input naruon's explicit "never" choice required) were added to the central reusable workflow in ContextualWisdomLab/.github#1732, after this caller's original PR opened. Re-pinning to the new commit picks up harden-runner for free before this PR's first merge -- no `with:` change needed, since this repo never set comment_summary_in_pr and the new input's default ("on-failure") matches the value this reusable workflow already hardcoded before. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/dependency-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 8f7015e6..5463adaf 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -14,6 +14,6 @@ concurrency: jobs: dependency-review: - uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@0bcd22d8bb07650aafb0a8f116e4c2bbb8744f03 + uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@5f8e5b2a79e709c4ab1a4179a605d34c458b13a1 with: fail_on_severity: moderate From 2015ee1177d3f726962d3434ff18a4f52ec0a1fd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 00:09:02 +0900 Subject: [PATCH 7/8] fix(test): sync CENTRAL_DEPENDENCY_REVIEW_WORKFLOW_SHA with the pinned workflow SHA dependency-review.yml pins to 5f8e5b2a79e709c4ab1a4179a605d34c458b13a1 (harden-runner + comment_summary_in_pr, .github#1732), but this test's constant was left at the stale 0bcd22d8... SHA, failing test_companion_workflows_pin_central_dependency_review_and_cover_osv_manifests. Same class of mistake caught in ContextualWisdomLab/newsdom-api#784; a peer session found this one after my own tree-grep check missed it (the file lives at tests/config/test_strix_static_repo_adaptations.py, not a readme-named path). Co-Authored-By: Claude Sonnet 5 --- tests/config/test_strix_static_repo_adaptations.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/config/test_strix_static_repo_adaptations.py b/tests/config/test_strix_static_repo_adaptations.py index 171bfb97..c2352078 100644 --- a/tests/config/test_strix_static_repo_adaptations.py +++ b/tests/config/test_strix_static_repo_adaptations.py @@ -8,7 +8,7 @@ OSV_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "osvscanner.yml" K8S_DEPLOYMENT = REPO_ROOT / "infra" / "k8s" / "deployment.yaml" K8S_SERVICE = REPO_ROOT / "infra" / "k8s" / "service.yaml" -CENTRAL_DEPENDENCY_REVIEW_WORKFLOW_SHA = "0bcd22d8bb07650aafb0a8f116e4c2bbb8744f03" +CENTRAL_DEPENDENCY_REVIEW_WORKFLOW_SHA = "5f8e5b2a79e709c4ab1a4179a605d34c458b13a1" def test_central_review_workflows_are_not_copied_into_this_repository() -> None: From 93c0de9f6c0ca43641fe0a4ef1db842540f6a2e6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 3 Sep 2026 10:01:32 +0900 Subject: [PATCH 8/8] ci(dependency-review): opt out of comment_summary_in_pr instead of implicitly needing write CodeRabbit: the central reusable workflow's default comment_summary_in_pr ("on-failure") forwards to dependency-review-action's comment-summary-in-pr, which needs pull-requests: write to post a PR comment. This caller only grants pull-requests: read, so an actual dependency-review failure would attempt to comment without permission. No PR summary comment is needed here -- explicitly opting out with "never" matches the already-declared read-only permission instead of escalating to write for a feature nothing here uses. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/dependency-review.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 5463adaf..3f3d6e06 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -17,3 +17,11 @@ jobs: uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@5f8e5b2a79e709c4ab1a4179a605d34c458b13a1 with: fail_on_severity: moderate + # The central workflow's default comment_summary_in_pr ("on-failure") + # forwards to dependency-review-action's comment-summary-in-pr, which + # needs pull-requests: write to post a PR comment. This caller only + # grants pull-requests: read, so an actual failure would try to comment + # without permission (CodeRabbit). No PR summary comment is needed here + # -- the job's own pass/fail status is the signal -- so this opts out + # explicitly rather than escalating to write. + comment_summary_in_pr: never