Found reviewing PR #316.
suggest-repairs:
needs: audit-network
if: ${{ github.event_name == 'workflow_dispatch' && inputs.suggest_repairs }}
A job with needs: is skipped when the needed job fails, and this if: carries no always() / !cancelled(). While audit-network was reporting-only it always ran; now that #316 restored the hard gate, any error-severity finding fails audit-network and skips suggest-repairs.
So the LLM repair-suggestion feature — whose entire purpose is proposing fixes for these findings — can now only run when there is nothing to fix.
Failure scenario: someone lands a dangling downstream.target, then dispatches the workflow with suggest_repairs: true to get suggestions. The job never starts.
Fix: if: ${{ !cancelled() && github.event_name == 'workflow_dispatch' && inputs.suggest_repairs }}.
Found reviewing PR #316.
A job with
needs:is skipped when the needed job fails, and thisif:carries noalways()/!cancelled(). Whileaudit-networkwas reporting-only it always ran; now that #316 restored the hard gate, any error-severity finding failsaudit-networkand skipssuggest-repairs.So the LLM repair-suggestion feature — whose entire purpose is proposing fixes for these findings — can now only run when there is nothing to fix.
Failure scenario: someone lands a dangling
downstream.target, then dispatches the workflow withsuggest_repairs: trueto get suggestions. The job never starts.Fix:
if: ${{ !cancelled() && github.event_name == 'workflow_dispatch' && inputs.suggest_repairs }}.