From 73d2ebee522e40d62ad05567410450acc1abf627 Mon Sep 17 00:00:00 2001 From: frJEN Date: Thu, 30 Jul 2026 18:42:59 +0930 Subject: [PATCH] ci: run dependency-review on forks too, not just upstream (#254) The job was gated with `github.repository == 'MadsLorentzen/ai-job-search'` on top of the pull_request check, so it never ran on any fork - including every adaptation listed in the community fork-index discussion. The job already probes Dependency graph availability and gracefully warns-and-passes when the graph isn't enabled, so the repository-name gate wasn't protecting against a real failure mode - it was just silently skipping vulnerability scanning everywhere except this one repo. Removing it lets any fork with Dependency graph enabled get real coverage, and costs nothing on repos where it isn't (the existing probe already handles that gracefully). --- .github/workflows/ci.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fdb1358..6526044 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -72,14 +72,14 @@ jobs: - run: python -m unittest discover -s tests -t . -v dependency-review: - name: Dependency review (upstream PRs only) - # Requires the repo's Dependency graph, which forks never inherit and - # which may be disabled upstream - so: upstream PRs only, and the - # graph is probed first. If it is unavailable, the job warns and - # passes instead of hard-failing (the same graceful-skip pattern the - # workflow uses for optional tools). Enabling Dependency graph under - # Settings -> Advanced Security activates the real check. - if: github.event_name == 'pull_request' && github.repository == 'MadsLorentzen/ai-job-search' + name: Dependency review + # Requires the repo's Dependency graph, which not every repo (upstream or + # fork) has enabled - so the graph is probed first, and the job warns and + # passes instead of hard-failing if it's unavailable (the same + # graceful-skip pattern the workflow uses for optional tools), rather than + # being gated to a specific repository. Enabling Dependency graph under + # Settings -> Advanced Security activates the real check on any repo. + if: github.event_name == 'pull_request' runs-on: ubuntu-latest steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4