ci: fix dependency-review permission cap and stop inherited fork noise#14
Merged
Merged
Conversation
dependency-review has failed with startup_failure on every pull request, including the ones opened today. The caller granted only contents: read, but the reusable public-dependency-review job declares contents: read and pull-requests: write, and GitHub caps the call against what the called file declares. github-device-sync and macos-ubuntu-bootstrap grant that pair on the identical reusable and SHA and both run clean. The Daily Security Audit has been red on main for five consecutive days, always at the Send to Slack step while the audit itself passed. gh secret list is empty for this repository, so SLACK_WEBHOOK_URL does not exist and curl was posting to an empty URL. Skip the notification when the webhook is unset, and quote the variable instead of leaving it to word splitting. top-issues.yml is removed rather than quarantined. Its job is gated on github.repository == 'browseros-ai/BrowserOS', so it has never run here, and it hardcodes the upstream owner and repo in both the GraphQL query and gh issue edit --repo browseros-ai/BrowserOS. It is structurally inert in a fork, and it fires on an hourly cron to skip.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three separate red or wasteful signals, all verified against real run history.
1.
dependency-review—startup_failureon every PRIncluding the ones opened today. No jobs are recorded at all, so nothing ran.
The caller granted only
contents: read. The reusablepublic-dependency-reviewjob declarescontents: readandpull-requests: write, and GitHub caps a reusable call against what the called file declares. Positive control:github-device-syncandmacos-ubuntu-bootstrapgrant that pair on the identical reusable and SHA, and both run clean.2.
Daily Security Audit— red on main five days runningEvery failure is at the
Send to Slackstep; the audit itself passes.gh secret listfor this repository returns empty, soSLACK_WEBHOOK_URLdoes not exist andcurlwas posting to an empty URL, which fails the step and the job.The notification is now skipped when the webhook is unset, and the variable is quoted rather than left to word splitting. This matters beyond tidiness: a security job that is always red is a job nobody reads.
3.
top-issues.yml— deleted, not quarantinedIts job is gated on
if: github.repository == 'browseros-ai/BrowserOS', so it has never run here — every run isskipped, on an hourly cron.Deletion rather than quarantine because the guard is not the only problem: the script hardcodes the upstream owner and repo in the GraphQL query (
-f owner='browseros-ai' -f repo='BrowserOS') and ingh issue edit --repo browseros-ai/BrowserOS. Even with the guard removed it would try to edit upstream's issue with this fork's scoped token. It is structurally inert in a fork.Note
actionlintflags a pre-existing SC2086 ataudit.yml:29, in a different step that I did not touch. Left alone to keep this diff scoped — worth a follow-up.Scope
The remaining ~25 inherited upstream workflows (13
release-*, the nightlies,eval-weekly,branch-cleaner, …) are not classified here. Deciding which a fork genuinely needs is not something to guess at, and the audit that would have produced that list did not complete. They are untouched.