py/ai-job-search
1
0
Fork 0
mirror of https://github.com/MadsLorentzen/ai-job-search.git synced 2026-09-17 00:26:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: run dependency-review on forks too, not just upstream (#254)

Browse Source 
The job was gated with `github.repository == 'MadsLorentzen/ai-job-search'`
on top of the pull_request check, so it never ran on any fork -
including every adaptation listed in the community fork-index
discussion. The job already probes Dependency graph availability and
gracefully warns-and-passes when the graph isn't enabled, so the
repository-name gate wasn't protecting against a real failure mode -
it was just silently skipping vulnerability scanning everywhere except
this one repo. Removing it lets any fork with Dependency graph enabled
get real coverage, and costs nothing on repos where it isn't (the
existing probe already handles that gracefully).
This commit is contained in:
frJEN
2026-07-30 11:12:59 +02:00
committed by GitHub
parent 7a753f3cd4
commit 73d2ebee52
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+8 -8
View File
@@ -72,14 +72,14 @@ jobs:
- run: python -m unittest discover -s tests -t . -v
dependency-review:
name: Dependency review (upstream PRs only)
# Requires the repo's Dependency graph, which forks never inherit and
# which may be disabled upstream - so: upstream PRs only, and the
# graph is probed first. If it is unavailable, the job warns and
# passes instead of hard-failing (the same graceful-skip pattern the
# workflow uses for optional tools). Enabling Dependency graph under
# Settings -> Advanced Security activates the real check.
if: github.event_name == 'pull_request' && github.repository == 'MadsLorentzen/ai-job-search'
name: Dependency review
# Requires the repo's Dependency graph, which not every repo (upstream or
# fork) has enabled - so the graph is probed first, and the job warns and
# passes instead of hard-failing if it's unavailable (the same
# graceful-skip pattern the workflow uses for optional tools), rather than
# being gated to a specific repository. Enabling Dependency graph under
# Settings -> Advanced Security activates the real check on any repo.
if: github.event_name == 'pull_request'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4