From 29badf6651591cd6786b841dc8fe4db3904a11e1 Mon Sep 17 00:00:00 2001 From: Robert Resch Date: Thu, 11 Jun 2026 17:38:42 +0200 Subject: [PATCH 01/15] Add basic security check to dependency workflow (#171191) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Martin Hjelmare --- .github/workflows/check-requirements.md | 112 +++++++++++++++++- script/check_requirements/models.py | 1 + script/check_requirements/render.py | 1 + script/check_requirements/runner.py | 11 ++ .../scripts/check_requirements/test_render.py | 4 + .../scripts/check_requirements/test_runner.py | 6 +- 6 files changed, 132 insertions(+), 3 deletions(-) diff --git a/.github/workflows/check-requirements.md b/.github/workflows/check-requirements.md index 1e96cdede0aa1..0bc780ef09a04 100644 --- a/.github/workflows/check-requirements.md +++ b/.github/workflows/check-requirements.md @@ -97,7 +97,9 @@ Read the JSON directly for the full schema. Key fields: with `status` of `pass`/`warn`/`fail`/`needs_agent` and `details`). - `rendered_comment` contains, for each `needs_agent` check, two placeholders to replace: - - `{{CHECK_CELL::}}` → exactly one of `✅`, `⚠️`, `❌`. + - `{{CHECK_CELL::}}` → exactly one of `✅`, `☑️`, `⚠️`, `❌`. The + **`security`** check kind uses `☑️` instead of `✅` for the success + case — see its section below for why. - `{{CHECK_DETAIL::}}` → ` ` (the bullet's `- **