ci: report dependency advisories without blocking merges by zoeyrose · Pull Request #39 · atrinik/sound

zoeyrose · 2026-10-12T02:01:23Z

Summary

Make dependency review an advisory report for dependency changes, including low-severity findings, so it informs the implementer without creating a CI merge barrier.

Implementation / behavior

Preserve the pinned official action and four ordinary PR event types, with no target-branch filter. Report on eligible PR runs where this workflow exists, using warn-only reporting, PR comments, and step-level continue-on-error.
Remove the unused merge-group trigger. This advisory workflow provides PR feedback and does not run queue analysis or create a required check.
Cancel older runs in a per-PR/ref concurrency group. The dependency action has a five-minute timeout; its raw-outcome failure reporter has a two-minute timeout within the ten-minute job.
On action failure in a non-cancelled run, preserve a warning and job summary first, then attempt to refresh the single owned bot advisory comment after bounded identity, pagination, critical comment-field ownership checks and current-head/base-ref/base-SHA fences. Permission, network, identity or reporting failures remain visible; missing reports mean unknown results.
Request only contents-read and pull-requests-write permissions. License findings remain enabled as advisories; no vulnerability exception catalog or allowlist is introduced.
Fork and Dependabot comment permission failures fall back to action warnings and the job summary. Operational errors remain visible and a green advisory job is not proof that dependencies are clean.
Before merge, the Codex implementer reads the latest job summary for the current PR head even if a bot comment exists, fixes actionable introduced risk, or records explicit maintainer acceptance of existing risk. This adds no human approval gate. License metadata does not certify compatibility; existing repository license policies still apply.
CodeQL and other CI validation remain unchanged.

Validation

Independent source review approved the exact patch and file hashes at base d15a71cc13126da17eeefb8cd984310342efcab7.
Focused actionlint, embedded ShellCheck, git diff --check, all-target branch semantics, and five raw outcome/conclusion cases passed; failure summaries were executed.
Independent security and integrated source reviews approved the exact V3 reporter and applicable guidance repair now committed in 7e2825f16f167c15c5e897feba6c12acc6092184; all 25 reporter tests passed.
Owner validation: tools/validate.sh passed 84 tests.
Final cancellation guard independently reviewed and committed in 72d740e0680c70030759a3f2882cf705389654c0; only the reporter condition changed, and reporter code/environments/guidance remain unchanged.

Limitations / follow-up

Live PR CI and requested Codex general/security reviews remain pending.
This source change does not apply organization settings, dispatch workflows, or alter other required checks. Review reporting availability separately from dependency safety.

github-actions · 2026-10-12T02:01:32Z

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

zoeyrose · 2026-10-12T02:02:20Z

@codex review

zoeyrose · 2026-10-12T02:02:27Z

@codex security review

chatgpt-codex-connector · 2026-10-12T02:02:34Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T05:02:26.109417Z	`72d740e`	Manual request
🔒 Security Review	✅ Completed 2026-10-12T05:04:21.272006Z	`72d740e`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-12T02:04:19Z

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 2d26db67c8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T02:05:44Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 2d26db67c8

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T02:28:10Z

@codex review

zoeyrose · 2026-10-12T02:28:17Z

@codex security review

chatgpt-codex-connector · 2026-10-12T02:30:49Z

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 66cf19ab7b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T02:31:27Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 66cf19ab7b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T02:55:16Z

@codex review

zoeyrose · 2026-10-12T02:55:18Z

@codex security review

chatgpt-codex-connector · 2026-10-12T02:57:58Z

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 33043d7f09

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T03:01:42Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 33043d7f09

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T03:30:59Z

@codex review

zoeyrose · 2026-10-12T03:31:02Z

@codex security review

chatgpt-codex-connector · 2026-10-12T03:34:05Z

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 03fec3f90b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T03:36:42Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 03fec3f90b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T04:03:28Z

@codex review

zoeyrose · 2026-10-12T04:03:31Z

@codex security review

chatgpt-codex-connector · 2026-10-12T04:06:33Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 7e2825f16f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

chatgpt-codex-connector · 2026-10-12T04:06:49Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 7e2825f16f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

zoeyrose · 2026-10-12T04:59:17Z

@codex review

zoeyrose · 2026-10-12T04:59:20Z

@codex security review

chatgpt-codex-connector · 2026-10-12T05:02:24Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 72d740e068

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T05:04:19Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 72d740e068

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

github-actions · 2026-10-12T06:03:44Z

🎉 This PR is included in version 1.2.0 🎉

The release is available on:

v1.2.0
GitHub release

Your semantic-release bot 📦🚀

ci: report dependency advisories without blocking merges

2d26db6

ci: keep dependency advisory reports current and visible

66cf19a

ci: report dependency advice on pull requests

33043d7

ci: refresh dependency advisory failure reports

03fec3f

ci: fence dependency advisory refreshes to current PR revisions

7e2825f

ci: skip advisory failure reporting on cancelled runs

72d740e

zoeyrose merged commit 642e5a2 into main Oct 12, 2026
11 of 12 checks passed

zoeyrose deleted the ci/advisory-dependency-review branch October 12, 2026 05:34

github-actions Bot added the released label Oct 12, 2026

Conversation

zoeyrose commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Implementation / behavior

Validation

Limitations / follow-up

Uh oh!

github-actions Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

Uh oh!

github-actions Bot commented Oct 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

zoeyrose commented Oct 12, 2026 •

edited

Loading

github-actions Bot commented Oct 12, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 12, 2026 •

edited

Loading