fix(actions): diagnose public dependency-review 403 fail closed

[seonghobae]

Owner outcome

This Draft is the current-main owner lane for a real required-workflow failure observed in ContextualWisdomLab/ConceptWeave.

ConceptWeave Foundation PR #1 predecessor head 8e8783286eac7567803568d9a91010daaf028074 reached hosted Security Scan run 33886162808. Dependency-review job 101108147137 checked out that exact head, then Check dependency review support observed HTTP 403 with curl exit 0 for public, non-fork ContextualWisdomLab/ConceptWeave; the job token had contents: read and pull-requests: read. The pinned dependency-review action never ran. This remains a real hosted owner-path RED, not queue or successor-head evidence.

RED → minimum owner repair

• 3298df61d97d055050808e32eb27890189b5ea38 adds the test-first regression contract for anomalous public/non-fork 403 responses while preserving final non-200 fail-closed behavior.
• 894a7dbf65ab1567fdce7dc8a80b711958dc66e8 records the exact consumer evidence, GitHub endpoint contract, alternatives and GREEN criterion.
• 0d6c0eb4152576cf8d4595daab0c8d9ea2febbe1 is the minimum production repair: the same job token may re-observe a public/non-fork 403 at most three total attempts, captures bounded non-secret X-GitHub-Request-Id, Retry-After and X-RateLimit-Remaining evidence, honors only a small numeric retry delay, and still refuses to set supported=true unless the final observation is HTTP 200. Private/internal repositories, forks, transport failures and every other non-200 remain immediate fail-closed paths.
• 0be4a07491322ce3a68fe769728a117452a43831 executes that exact extracted workflow Bash body against a deterministic curl double: 403→403→200 reaches supported=true only on the observed 200; persistent public/non-fork 403 fails after exactly three attempts; private or fork 403 fails after one attempt. It also verifies request-id diagnostics and response-body suppression.

The production workflow patch remains confined to the dependency-review support preflight; the pinned dependency-review action, severity policy and sibling scanners are unchanged.

Current-main restack

Protected .github/main subsequently advanced through the queue/admission and test repairs to b5efbc2762e472e4a380b0503b1f050f76fbb008. The intervening main delta is disjoint from this PR's three owner files. It was adopted with a two-parent non-force restack: current exact head 41935494aa234eb458f1cc08f006daaa278b9760 has prior owner head 4e585ecd3d9f8e2b419ac82c06a5b363b6c7e20d as first parent and protected main@b5efbc2762e472e4a380b0503b1f050f76fbb008 as second parent. Comparing current main to this head reports behind_by=0 and only these three effective files: .github/workflows/security-scan.yml, docs/doctoring/dependency-review-public-required-workflow-403-20260905.md, and tests/test_dependency_review_public_required_workflow_403.py.

Exact-head execution evidence

The predecessor restack head 4e585ecd... materialized Python Security 33929094887, SAST Semgrep 33929094960, CodeQL PR 33929094940, and Security Scan 33929094962; all reached terminal cancelled before useful execution. That non-passing evidence is retained as historical cancellation/admission evidence and is not transferred to the successor.

Fresh pull-request workflows have materialized for exact successor 41935494...: SAST Semgrep 33934066968, Python Security 33934066954, CodeQL PR 33934067035, and Security Scan 33934067074. At the current observation all four are queued, so this successor is not GREEN and no predecessor/local evidence is substituted.

No blind/no-op rerun is authorized. Queueing blocks only this validation lane; if a run fails after execution, perform RCA against that exact head before another mutation.

Relation to #1725

PR #1725 remains valid historical/canonical work for non-200 fail-closed behavior and least-privilege caller permissions, but its branch is deeply diverged from protected main. It was not force-restacked or discarded. This current-main successor carries the newly observed ConceptWeave consumer defect class without weakening #1725's core invariant: only final HTTP 200 may authorize the pinned dependency-review action.

An anonymous preflight is deliberately not used. GitHub permits unauthenticated reads for public dependency-diff resources, but the pinned action itself defaults to github.token; anonymous preflight success could therefore be false support evidence if the action fails with the same token.

Exact-head GREEN gate

Require unchanged 41935494... or a causally repaired non-force successor to obtain terminal owner CI/review evidence, then land through ordinary protection. After protected integration, obtain a fresh unchanged ConceptWeave consumer run where the dependency-review action itself reaches a terminal result. A repeated terminal 403 remains a hard failure with request/rate evidence for further RCA.

No 403-as-success, scanner skip, anonymous-success substitution, self-approval, admin bypass, force push, predecessor-evidence transfer, or no-op rerun is authorized.

Refs #1725.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Root cause verified on 2026-09-05: the same authenticated exact-range request returned 200 for naruon but 403 for pingora-gateway and ConceptWeave. Enabling Dependabot vulnerability alerts initialized the dependency graph in each affected public non-fork repository; both exact base/head compare endpoints changed to HTTP 200 immediately. This draft’s same-token retries and sleeps would only extend queue occupancy and do not repair repository capability, so the workflow change is no longer needed. Closing without merge; the dependency-review hard gate remains fail-closed.