From 6733e9db671c2200d6b701df9ba5084f67c30d83 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 8 Jul 2026 11:55:34 +0900 Subject: [PATCH 1/2] fix: align release-governance tests with central Security Scan migration (#926) PR #926 ("stop duplicating central Security Scan on PRs") intentionally removed the per-repo PR security-scan copies: it deleted .github/workflows/dependency-review.yml and dropped the `pull_request:` triggers from scorecard.yml and trivy.yml, because dependency-review, osv-scan, trivy-fs and scorecard now run via the org-level required "Security Scan" workflow on PRs. The governance tests still asserted the old per-repo contract, so the full backend pytest suite failed on every open PR, blocking the coverage-evidence gate develop-wide. Update tests/test_release_governance.py to the current intentional state: - test_stepsecurity_remediation_adds_pinned_audit_hardening: drop dependency-review.yml from the per-repo hardened-workflow list and remove the dependency-review-action pin assertion (file no longer exists in this repo). - test_required_code_scanning_workflows_upload_scorecard_and_trivy_sarif: replace the stale `pull_request:` trigger assertion with a positive guard that the per-repo `pull_request:` trigger stays removed (so the central scan is not re-duplicated) while push/develop/master coverage and all SARIF-upload governance remain asserted. No genuine governance weakened: every still-valid pin, permission, SARIF and hardening assertion is retained. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01RTAMs4bpSZS77Xe3RQjv9P --- backend/tests/test_release_governance.py | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/backend/tests/test_release_governance.py b/backend/tests/test_release_governance.py index 9a4ec97df..e500f7df2 100644 --- a/backend/tests/test_release_governance.py +++ b/backend/tests/test_release_governance.py @@ -224,11 +224,15 @@ def test_stepsecurity_remediation_adds_pinned_audit_hardening() -> None: harden_runner_ref = ( "step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4" ) + # NOTE: .github/workflows/dependency-review.yml was intentionally removed in + # PR #926 ("stop duplicating central Security Scan on PRs"). Dependency review + # now runs via the org-level required "Security Scan" workflow, so this repo no + # longer ships its own per-repo copy. The per-repo hardening/pinning assertions + # below therefore only cover the workflows that remain in this repository. hardened_workflows = [ ".github/workflows/app-ci.yml", ".github/workflows/bandit.yml", ".github/workflows/codeql.yml", - ".github/workflows/dependency-review.yml", ".github/workflows/docker-publish.yml", ".github/workflows/mail-smoke.yml", ".github/workflows/pr-governance.yml", @@ -241,14 +245,6 @@ def test_stepsecurity_remediation_adds_pinned_audit_hardening() -> None: assert harden_runner_ref in workflow assert "egress-policy: audit" in workflow - dependency_review_workflow = read_repo_text( - ".github/workflows/dependency-review.yml" - ) - assert ( - "actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0" - in dependency_review_workflow - ) - pre_commit = read_repo_text(".pre-commit-config.yaml") assert "https://github.com/gitleaks/gitleaks" in pre_commit assert "rev: v8.16.3" in pre_commit @@ -356,7 +352,14 @@ def test_required_code_scanning_workflows_upload_scorecard_and_trivy_sarif() -> trivy_workflow = read_repo_text(".github/workflows/trivy.yml") for workflow in (scorecard_workflow, trivy_workflow): - assert "pull_request:" in workflow + # PR #926 ("stop duplicating central Security Scan on PRs") removed the + # per-repo `pull_request:` triggers from scorecard.yml and trivy.yml. + # PR-time scorecard/trivy coverage is now provided by the org-level + # required "Security Scan" workflow, so the per-repo copies only run on + # push to the release branches. Assert the migration stays in place: the + # push triggers remain and no per-repo `pull_request:` trigger is + # re-introduced (which would re-duplicate the central scan). + assert "pull_request:" not in workflow assert "push:" in workflow assert "- develop" in workflow assert "- master" in workflow From 7829bdede2533f22ba29d688dca39d7e25e71583 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 12 Jul 2026 06:34:30 +0000 Subject: [PATCH 2/2] =?UTF-8?q?fix:=20resolve=20merge=20conflicts=20with?= =?UTF-8?q?=20develop=20=E2=80=94=20restore=20dependency-review=20and=20pu?= =?UTF-8?q?ll=5Frequest=20triggers?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/tests/test_release_governance.py | 41 ++++++++++++++++-------- 1 file changed, 28 insertions(+), 13 deletions(-) diff --git a/backend/tests/test_release_governance.py b/backend/tests/test_release_governance.py index d67b1b558..7bde22613 100644 --- a/backend/tests/test_release_governance.py +++ b/backend/tests/test_release_governance.py @@ -305,15 +305,11 @@ def test_stepsecurity_remediation_adds_pinned_audit_hardening() -> None: harden_runner_ref = ( "step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4" ) - # NOTE: .github/workflows/dependency-review.yml was intentionally removed in - # PR #926 ("stop duplicating central Security Scan on PRs"). Dependency review - # now runs via the org-level required "Security Scan" workflow, so this repo no - # longer ships its own per-repo copy. The per-repo hardening/pinning assertions - # below therefore only cover the workflows that remain in this repository. hardened_workflows = [ ".github/workflows/app-ci.yml", ".github/workflows/bandit.yml", ".github/workflows/codeql.yml", + ".github/workflows/dependency-review.yml", ".github/workflows/docker-publish.yml", ".github/workflows/mail-smoke.yml", ".github/workflows/pr-governance.yml", @@ -326,6 +322,32 @@ def test_stepsecurity_remediation_adds_pinned_audit_hardening() -> None: assert harden_runner_ref in workflow assert "egress-policy: audit" in workflow + dependency_review_workflow = read_repo_text( + ".github/workflows/dependency-review.yml" + ) + assert ( + "actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0" + in dependency_review_workflow + ) + assert "BASE_REF: ${{ github.base_ref || github.ref_name }}" in ( + dependency_review_workflow + ) + assert "HEAD_REF: ${{ github.head_ref || github.ref_name }}" in ( + dependency_review_workflow + ) + log_dependency_review_step = dependency_review_workflow.split( + "- name: Log dependency review policy", 1 + )[1].split("- name: Review dependency changes", 1)[0] + log_dependency_review_script = log_dependency_review_step.split("run: |", 1)[1] + assert "${{ github.base_ref || github.ref_name }}" not in ( + log_dependency_review_script + ) + assert "${{ github.head_ref || github.ref_name }}" not in ( + log_dependency_review_script + ) + assert 'printf \'Base ref: %s\\n\' "$BASE_REF"' in log_dependency_review_script + assert 'printf \'Head ref: %s\\n\' "$HEAD_REF"' in log_dependency_review_script + pre_commit = read_repo_text(".pre-commit-config.yaml") assert "https://github.com/gitleaks/gitleaks" in pre_commit assert "rev: v8.16.3" in pre_commit @@ -426,14 +448,7 @@ def test_required_code_scanning_workflows_upload_scorecard_and_trivy_sarif() -> trivy_workflow = read_repo_text(".github/workflows/trivy.yml") for workflow in (scorecard_workflow, trivy_workflow): - # PR #926 ("stop duplicating central Security Scan on PRs") removed the - # per-repo `pull_request:` triggers from scorecard.yml and trivy.yml. - # PR-time scorecard/trivy coverage is now provided by the org-level - # required "Security Scan" workflow, so the per-repo copies only run on - # push to the release branches. Assert the migration stays in place: the - # push triggers remain and no per-repo `pull_request:` trigger is - # re-introduced (which would re-duplicate the central scan). - assert "pull_request:" not in workflow + assert "pull_request:" in workflow assert "push:" in workflow assert "- develop" in workflow assert "- master" in workflow