ci(workflows): use central reusable dependency-review.yml - #556
Conversation
Replace this repo's hand-written dependency-review.yml with a thin caller into ContextualWisdomLab/.github's new workflow_call workflow (fail-on- severity: moderate, continue-on-error: true preserved exactly), and add the cancel-in-progress concurrency group this workflow previously lacked. See ContextualWisdomLab/.github#1724 (the central workflow) and docs/adr/0024-dependency-review-reusable-workflow-consolidation.md / docs/doctoring/dependency-review-reusable-workflow-consolidation.md there for the full audit and design rationale. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 3 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| run: | | ||
| echo "Dependency Review requires GitHub Dependency Graph to be enabled for this repository." | ||
| echo "OSV-Scanner remains the blocking dependency vulnerability gate." | ||
| uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@main |
There was a problem hiding this comment.
🟡 Dependency review cannot start
dependency-review references @main, but that branch does not contain the reusable workflow. Every pull request run fails before dependency review starts.
Prompt for agents
The caller in .github/workflows/dependency-review.yml references ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@main, but the central repository's main branch does not contain that file. It exists only on the unmerged ContextualWisdomLab/.github#1724 head. Ensure the central workflow is merged and available at the referenced revision before merging or running this caller, or temporarily reference an available immutable revision and update it after the central change lands.
Was this helpful? React with 👍 or 👎 to provide feedback.
| run: | | ||
| echo "Dependency Review requires GitHub Dependency Graph to be enabled for this repository." | ||
| echo "OSV-Scanner remains the blocking dependency vulnerability gate." | ||
| uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@main |
There was a problem hiding this comment.
🟨 Mutable workflow reference permits unreviewed changes
dependency-review trusts another repository's mutable @main branch. Later central changes execute here without a reviewed caller update.
Was this helpful? React with 👍 or 👎 to provide feedback.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| run: | | ||
| echo "Dependency Review requires GitHub Dependency Graph to be enabled for this repository." | ||
| echo "OSV-Scanner remains the blocking dependency vulnerability gate." | ||
| uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@main |
2 participants
Summary
dependency-review.ymlwith a thin caller intoContextualWisdomLab/.github's newworkflow_callreusable workflow (feat(workflows): add reusable dependency-review.yml for 4 product repos .github#1724), preserving this repo's exact original policy:fail-on-severity: moderate,continue-on-error: true.concurrencygroup this workflow previously lacked, consistent with the org-wide concurrency-standardization pass.See ContextualWisdomLab/.github#1724 and its
docs/adr/0024-.../docs/doctoring/dependency-review-reusable-workflow-consolidation.mdfor the full field-by-field audit and design rationale.Test plan
python3 -c "import yaml; yaml.safe_load(...)"on the new calleractionlint .github/workflows/dependency-review.ymlmain(this caller references@main, so it will resolve once that PR merges)🤖 Generated with Claude Code