Skip to content

Commit 62beff1

Browse files
lelialelia
authored
Harden dependency review checks across PR types (#224)
* ci: report e2e-* checks on fork and Dependabot PRs The e2e job is skipped on PRs that can't access repository secrets (forks and Dependabot). Because it's skipped via a job-level `if`, its matrix never expands, so the required e2e-* check contexts are never created and branch protection waits on them indefinitely, blocking merge. Add an e2e-bypass job whose `if` is the exact negation of the e2e job's run condition. It emits the same e2e-* check names with a passing status for fork/Dependabot PRs, satisfying branch protection without running the real tests. The two jobs are mutually exclusive and exhaustive: every PR runs exactly one. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * ci: add dependency-review-gate aggregator check The Socket Firewall enterprise smoke job is the most meaningful supply-chain check for maintainer-added dependencies, but it can't be required directly: it's conditional (per-manifest, and free-vs-enterprise per author), so on most PRs it's legitimately skipped -- and a required check whose job is skipped sits at "Expected -- Waiting for status" forever, blocking merge (the same trap that stranded Dependabot PRs on the e2e-* checks). Add a dependency-review-gate job that always runs and collapses every smoke job into one pass/fail signal: it fails iff any job that ran ended in failure or was cancelled; success and skipped both pass. This is the single check intended to be marked required later -- it satisfies Dependabot/fork PRs (which run Firewall-free) and maintainer PRs (Firewall-enterprise) alike, and turns a Socket Firewall BLOCK into a merge-blocking failure instead of a non-required job nobody is forced to run. Scaffolding only: the gate is not yet added to branch protection's required checks (deferred until it's merged to main and observed reporting). Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * chore: bump CLI to 2.4.5 and require socketdev>=3.2.1 Follows the 2.4.4 release (SDK >=3.2.0) by picking up socketdev 3.2.1. Regenerates uv.lock to the published 3.2.1 release; no CLI logic changes. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> --------- Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
1 parent 448d20c commit 62beff1

6 files changed

Lines changed: 111 additions & 8 deletions

File tree

‎.github/workflows/dependency-review.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -586,3 +586,68 @@ jobs:
586586
echo "This PR changes workflow, composite-action, or dependabot config files."
587587
echo "Require explicit human review before merge."
588588
} >> "$GITHUB_STEP_SUMMARY"
589+
590+
# Single required status check that aggregates the conditional smoke jobs
591+
# above. Branch protection can't require those jobs individually: each is
592+
# conditional (per-manifest, and Firewall-free vs -enterprise per author), so
593+
# on any given PR most are legitimately skipped -- and a required check whose
594+
# job is skipped sits at "Expected -- Waiting for status to be reported"
595+
# forever, blocking merge (the same trap that stranded Dependabot PRs on the
596+
# e2e-* checks).
597+
#
598+
# This gate always runs (if: always(), so it reports even when upstream jobs
599+
# are skipped or fail) and collapses them into one pass/fail signal: it FAILS
600+
# if any smoke job that ran ended in failure or was cancelled, and passes when
601+
# everything either succeeded or was not applicable. 'skipped' is expected and
602+
# allowed -- it just means the job didn't apply to this PR.
603+
#
604+
# Mark THIS check (dependency-review-gate) required in branch protection. It
605+
# satisfies Dependabot/fork PRs (which run the Firewall-free job) and
606+
# maintainer PRs (which run Firewall-enterprise) alike, and -- crucially -- a
607+
# Socket Firewall BLOCK now fails the gate and blocks merge, instead of living
608+
# in a non-required enterprise job that nobody is forced to run.
609+
dependency-review-gate:
610+
needs:
611+
- inspect
612+
- python-sfw-smoke-free
613+
- python-sfw-smoke-enterprise
614+
- fixture-npm-sfw-smoke-free
615+
- fixture-npm-sfw-smoke-enterprise
616+
- fixture-pypi-sfw-smoke-free
617+
- fixture-pypi-sfw-smoke-enterprise
618+
- dockerfile-smoke
619+
if: always()
620+
runs-on: ubuntu-latest
621+
timeout-minutes: 2
622+
steps:
623+
- name: Verify no smoke job failed
624+
env:
625+
RESULTS: ${{ toJSON(needs) }}
626+
run: |
627+
echo "Upstream job results:"
628+
printf '%s\n' "$RESULTS" | python3 -m json.tool
629+
630+
# Fail the gate if any needed job ended in failure or was cancelled.
631+
# 'success' and 'skipped' both pass: skipped means the job did not
632+
# apply to this PR (wrong manifest, or free-vs-enterprise mismatch).
633+
failed="$(printf '%s\n' "$RESULTS" | python3 -c "
634+
import json, sys
635+
data = json.load(sys.stdin)
636+
bad = [name for name, info in data.items()
637+
if info.get('result') in ('failure', 'cancelled')]
638+
print(' '.join(sorted(bad)))
639+
")"
640+
641+
if [ -n "$failed" ]; then
642+
echo "::error::dependency-review smoke job(s) failed: $failed"
643+
{
644+
echo "## Dependency Review Gate: FAILED"
645+
echo "The following smoke job(s) failed or were cancelled: \`$failed\`"
646+
echo "If a Socket Firewall job is listed, it likely BLOCKED an install --"
647+
echo "inspect its uploaded sfw-artifacts/ report before merging."
648+
} >> "$GITHUB_STEP_SUMMARY"
649+
exit 1
650+
fi
651+
652+
echo "All dependency-review smoke jobs passed or were not applicable."
653+
echo "## Dependency Review Gate: PASSED" >> "$GITHUB_STEP_SUMMARY"

‎.github/workflows/e2e-test.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,3 +104,34 @@ jobs:
104104
env:
105105
SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
106106
run: bash ${{ matrix.validate }}
107+
108+
# Branch protection requires the e2e-* checks, but the `e2e` job above is
109+
# skipped on PRs that can't access repository secrets -- fork PRs and
110+
# Dependabot PRs. A job skipped via a job-level `if` never expands its
111+
# matrix, so the e2e-* check contexts are never created and the required
112+
# checks sit at "Expected -- Waiting for status to be reported" forever,
113+
# permanently blocking merge.
114+
#
115+
# This bypass reports a green status under the SAME e2e-* check names for
116+
# exactly those PRs, satisfying branch protection without running the real
117+
# tests (which need SOCKET_CLI_API_TOKEN). Its `if` is the precise negation
118+
# of the e2e job's run condition, so the two are mutually exclusive: any
119+
# given PR runs one or the other, never both, and never neither.
120+
#
121+
# Dependency-bump risk on these PRs is still covered by dependency-review.yml's
122+
# Socket Firewall smoke jobs, which run without repository secrets.
123+
e2e-bypass:
124+
if: >-
125+
github.event_name == 'pull_request' &&
126+
(github.event.pull_request.head.repo.full_name != github.repository ||
127+
github.event.pull_request.user.login == 'dependabot[bot]')
128+
runs-on: ubuntu-latest
129+
strategy:
130+
matrix:
131+
name: [scan, sarif, reachability, gitlab, json, pypi]
132+
name: e2e-${{ matrix.name }}
133+
steps:
134+
- name: Report skip status
135+
run: |
136+
echo "Skipping e2e-${{ matrix.name }} for a PR without repository secrets"
137+
echo "(fork or Dependabot). Dependency risk is covered by dependency-review.yml."

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Changelog
22

3+
## 2.4.5
4+
5+
### Changed: Bump required SDK version to `>=3.2.1`
6+
7+
- Picks up `socketdev 3.2.1`.
8+
- No CLI logic changes.
9+
310
## 2.4.4
411

512
### Changed: Bump required SDK version to `>=3.2.0`

‎pyproject.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
66

77
[project]
88
name = "socketsecurity"
9-
version = "2.4.4"
9+
version = "2.4.5"
1010
requires-python = ">= 3.11"
1111
license = {"file" = "LICENSE"}
1212
dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
1616
'GitPython',
1717
'packaging',
1818
'python-dotenv',
19-
"socketdev>=3.2.0,<4.0.0",
19+
"socketdev>=3.2.1,<4.0.0",
2020
"bs4>=0.0.2",
2121
"markdown>=3.10",
2222
"brotli>=1.0.9; platform_python_implementation == 'CPython'",

‎socketsecurity/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
__author__ = 'socket.dev'
2-
__version__ = '2.4.4'
2+
__version__ = '2.4.5'
33
USER_AGENT = f'SocketPythonCLI/{__version__}'

‎uv.lock‎

Lines changed: 5 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)