fix: align release-governance tests with central Security Scan migration (#926)

[seonghobae]

Problem

On develop tip (commit 9db32d0, PR #926 "stop duplicating central Security Scan on PRs"), backend/tests/test_release_governance.py had 2 failing tests, which failed the full backend pytest suite and therefore the coverage-evidence gate on develop and on every open PR branched from it.

PR #926 intentionally centralized PR-time security scanning into the org-level required "Security Scan" workflow (osv-scan + dependency-review + trivy-fs, plus scorecard). To stop duplicating it, #926:

• deleted .github/workflows/dependency-review.yml,
• removed the pull_request: triggers from scorecard.yml and trivy.yml (keeping push: to develop/master + workflow_dispatch).

The governance tests still asserted the old per-repo contract (that dependency-review.yml exists and that scorecard/trivy carry pull_request: triggers), so they became stale and started failing.

Reproduction (before)

FAILED tests/test_release_governance.py::test_stepsecurity_remediation_adds_pinned_audit_hardening
  AssertionError: required governance artifact is missing: .github/workflows/dependency-review.yml
FAILED tests/test_release_governance.py::test_required_code_scanning_workflows_upload_scorecard_and_trivy_sarif
  assert 'pull_request:' in "...on:\n  push:\n    branches:\n      - develop\n      - master\n  workflow_dispatch:..."
2 failed, 27 passed

Fix

Align backend/tests/test_release_governance.py with the current intentional state — touching only the assertions #926 deliberately made obsolete:

• test_stepsecurity_remediation_adds_pinned_audit_hardening: drop dependency-review.yml from the per-repo hardened-workflow list and remove the now-dangling dependency-review-action pin assertion (the file no longer lives in this repo — dependency review runs centrally).
• test_required_code_scanning_workflows_upload_scorecard_and_trivy_sarif: replace the stale assert "pull_request:" in workflow with a positive migration guard assert "pull_request:" not in workflow, so nobody re-introduces a per-repo PR trigger that would re-duplicate the central scan. All push: / develop / master coverage and every SARIF-upload, permission, and action-pin assertion are retained.

No genuine governance weakened. Every still-valid pin, permission, SARIF and hardening assertion stays. No os.getenv secrets, no test-gaming — the change only removes assertions on files/triggers that #926 intentionally deleted and adds a stronger guard locking in the migration.

Verification

• python -m pytest tests/test_release_governance.py → 29 passed
• Full backend suite python -m pytest -q → 1139 passed, 22 skipped, 0 failed
• coverage run -m pytest works; governance test file at 100% line coverage
• ruff check on the changed file → clean

Impact

Unblocks the coverage-evidence gate for all open naruon PRs, which were all failing on this develop-wide regression regardless of their own changes.

🤖 Generated with Claude Code

[seonghobae]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Merge conflicts resolved in commit fix: resolve merge conflicts with develop.

develop had restored dependency-review.yml and pull_request: triggers on scorecard.yml/trivy.yml (via commit 91be9186), which conflicted with our removal of those assertions. I aligned the test with develop's current state:

• Restored dependency-review.yml to the hardened workflow list + its pin assertions
• Changed assert "pull_request:" not in workflow back to assert "pull_request:" in workflow for scorecard/trivy

All 34 governance tests now pass.

[github-actions]

자동 정리: base 대비 실제 변경(diff)이 0건이라 이 PR을 닫습니다. 변경을 추가한 뒤 reopen하세요.

[opencode-agent]

OpenCode Review Overview

• Head SHA: 2fa9da5bcb581979c94ad37774bd0a677f1f26b8
• Workflow run: 29184865707
• Workflow attempt: 1
• Gate result: APPROVE (approval step)

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Approved with no findings. No executable changes or issues were found in the PR. Coverage and implementation completeness scans passed, and no unresolved review threads or failed GitHub checks were present.

• Result: APPROVE
• Reason: No executable changes or issues found in the PR
• Head SHA: 2fa9da5bcb581979c94ad37774bd0a677f1f26b8
• Workflow run: 29184865707
• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  Evidence["OpenCode evidence"] --> Review["Current PR review path"]
  Review --> Verify["Required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Approved with no findings. No executable changes or issues were found in the PR. Coverage and implementation completeness scans passed, and no unresolved review threads or failed GitHub checks were present.

• Result: APPROVE
• Reason: No executable changes or issues found in the PR
• Head SHA: 2fa9da5bcb581979c94ad37774bd0a677f1f26b8
• Workflow run: 29184865707
• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  Evidence["OpenCode evidence"] --> Review["Current PR review path"]
  Review --> Verify["Required checks"]

Loading