ci: report dependency advisories without blocking merges by zoeyrose · Pull Request #30 · atrinik/tools

zoeyrose · 2026-10-12T02:02:32Z

Summary

Make dependency review nonblocking advisory feedback for eligible ordinary pull-request runs where this workflow exists, with no target-branch filter so introduced risks are visible to implementing agents without adding a CI merge barrier.

Implementation / behavior

Keep the official immutable dependency-review action pin and snapshot retries; report runtime, development, and unknown scopes from low severity upward with warn-only: true, license metadata reporting enabled (repository license-compatibility rules still apply), and PR summaries always enabled.
Cancel superseded runs using PR-scoped concurrency. This advisory workflow has no merge-group trigger and does not backport itself onto historical branches. Give the action an ID and publish an explicit warning plus job summary whenever its raw outcome is failure, including tolerated failures whose conclusion is success. The bounded Python reporter refreshes or creates only the verified GitHub Actions bot marker comment after repository, comment ownership, pagination and fresh PR-head checks; ambiguous comments, redirects, permission failures and changed heads retain summary evidence without unsafe writes. Use a 5-minute action timeout, 2-minute reporter timeout and 10-minute job timeout. If the report is absent, vulnerability/license results remain unknown.
Grant only contents read and pull-request comment write permissions. The action retains job-summary/log feedback when fork or Dependabot comment permissions are unavailable; action/API errors remain visible and step-level continue-on-error keeps this advisory job nonblocking. A green advisory job does not prove a clean scan.
Require implementing agents to read the latest current-PR-head job summary even when a PR comment exists, because comments can be stale, fix actionable introduced risks, or record explicit maintainer acceptance of existing risk before merge. No advisory allowlist, catalog requirement, or human approval gate is added.
Preserve CodeQL, existing validation/security CI, audit-delta contracts, and all dependency locks.

Validation

Focused actionlint, Python syntax checks, git diff --check, all-PR-target coverage, and independent exact-patch review passed. Five outcome/conclusion cases verified tolerated-failure detection. All 20 mocked V2 reporter tests passed; the exact reporter hash and semantic workflow equality match the independent security-approved canonical artifact.
The published commit matches the independently approved patch and file hashes from a freshly verified main base.

Limitations / follow-up

Live PR CI and the requested Codex reviews remain pending. Application builds were not run for this workflow/documentation-only patch.
Implementing agents must assess advisory findings and visible scan/API errors before merge; missing feedback is not a clean result.

github-actions · 2026-10-12T02:02:40Z

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

zoeyrose · 2026-10-12T02:02:51Z

@codex review

zoeyrose · 2026-10-12T02:02:55Z

@codex security review

chatgpt-codex-connector · 2026-10-12T02:03:04Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T05:02:49.295771Z	`ae3d27c`	Manual request
🔒 Security Review	✅ Completed 2026-10-12T05:06:18.186186Z	`ae3d27c`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-12T02:05:17Z

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 99d9c49401

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T02:05:25Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 99d9c49401

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T02:28:40Z

@codex review

zoeyrose · 2026-10-12T02:28:43Z

@codex security review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a5182d8842

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T02:32:21Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: a5182d8842

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T02:55:34Z

@codex review

zoeyrose · 2026-10-12T02:55:37Z

@codex security review

chatgpt-codex-connector · 2026-10-12T02:58:30Z

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: b45959d270

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T02:59:39Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: b45959d270

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T03:33:03Z

@codex review

zoeyrose · 2026-10-12T03:33:07Z

@codex security review

chatgpt-codex-connector · 2026-10-12T03:35:30Z

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 8e5bd2e14c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T03:37:30Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8e5bd2e14c

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T04:03:17Z

@codex review

zoeyrose · 2026-10-12T04:03:20Z

@codex security review

chatgpt-codex-connector · 2026-10-12T04:06:47Z

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 76edd921b4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T04:09:51Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 76edd921b4

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T04:59:38Z

@codex review

zoeyrose · 2026-10-12T04:59:42Z

@codex security review

chatgpt-codex-connector · 2026-10-12T05:02:47Z

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: ae3d27c290

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T05:06:16Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: ae3d27c290

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

ci: report dependency advisories without blocking merges

99d9c49

ci: keep dependency advisory reports current and visible

a5182d8

chatgpt-codex-connector Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread .github/workflows/dependency-review.yml Resolved

ci: report dependency advice on pull requests

b45959d

ci: keep dependency advisory feedback current

8e5bd2e

ci: fence dependency advisory report updates

76edd92

ci: skip dependency advisory reporting after cancellation

ae3d27c

zoeyrose merged commit c2e680f into main Oct 12, 2026
6 checks passed

zoeyrose deleted the ci/advisory-dependency-review branch October 12, 2026 05:13

Conversation

zoeyrose commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Implementation / behavior

Validation

Limitations / follow-up

Uh oh!

github-actions Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

zoeyrose commented Oct 12, 2026 •

edited

Loading

github-actions Bot commented Oct 12, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 12, 2026 •

edited

Loading