ayobamiseun 2a6cb8cfec ci: probe Dependency graph before dependency-review - warn and pass when unavailable ...

The upstream PR run showed Dependency graph is disabled on the upstream
repo too (the action hard-fails: 'Dependency review is not supported on
this repository'), not just on forks. Only the repo owner can enable it,
so a hard red X here is friction, not signal.

The job now probes the dependency-graph SBOM endpoint with the workflow
token first: HTTP 200 runs the real review; anything else emits a
::warning:: naming the setting to flip (Settings -> Advanced Security ->
Dependency graph) and passes. Same graceful-skip pattern the workflow
uses for optional tools - the check self-activates the moment the graph
is enabled, no workflow change needed.

2026-07-08 23:51:51 +01:00

..

ci.yml

ci: probe Dependency graph before dependency-review - warn and pass when unavailable

2026-07-08 23:51:51 +01:00