Propagate changes from main into development#993
Conversation
When docker-build.yml skips the build for renovate/chore PRs, no docker image artifact is uploaded. Previously, security-pr.yml would crash with reason_category=not_found when the artifact was missing, treating an intentional skip as a hard failure. The fix distinguishes "artifact not found" from API errors: missing artifacts now set artifact_exists=false and exit cleanly. The download and image-load steps are guarded by this output, so the entire artifact path is skipped gracefully. Downstream scan steps were already gated on artifact_exists==true, so no further changes are needed. Renovate dependency PRs will now produce a passing (no-op) security scan job rather than a failed one.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Propagates updates from main into development by adjusting the security PR workflow to treat missing build artifacts as a non-fatal condition and skip downstream steps.
Changes:
- Change missing-artifact handling from failing the job to exiting successfully with an output flag.
- Gate artifact download and Docker image loading on a new
artifact_existsoutput.
| if [[ -z "${ARTIFACT_ID}" ]]; then | ||
| echo "❌ reason_category=not_found" | ||
| echo "reason=Required artifact was not found" | ||
| echo "⚠️ reason_category=not_found" | ||
| echo "reason=Artifact not found — build was likely skipped (e.g., renovate/chore PR)" | ||
| echo "upstream_run_id=${RUN_ID}" | ||
| echo "artifact_name=${ARTIFACT_NAME}" | ||
| exit 1 | ||
| echo "artifact_exists=false" >> "$GITHUB_OUTPUT" | ||
| exit 0 | ||
| fi |
There was a problem hiding this comment.
The workflow now gates downstream steps on steps.check-artifact.outputs.artifact_exists == 'true', but this diff only sets artifact_exists=false in the not-found branch. Unless artifact_exists=true is written to $GITHUB_OUTPUT in the found-artifact path elsewhere in this step, artifact_exists will be empty and both the download and load steps will be skipped even when the artifact exists. Ensure the found-artifact path sets artifact_exists=true (and does so before the step exits) so the gating condition works as intended.
|
|
||
| - name: Download PR image artifact | ||
| if: github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch' | ||
| if: (github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch') && steps.check-artifact.outputs.artifact_exists == 'true' |
There was a problem hiding this comment.
The workflow now gates downstream steps on steps.check-artifact.outputs.artifact_exists == 'true', but this diff only sets artifact_exists=false in the not-found branch. Unless artifact_exists=true is written to $GITHUB_OUTPUT in the found-artifact path elsewhere in this step, artifact_exists will be empty and both the download and load steps will be skipped even when the artifact exists. Ensure the found-artifact path sets artifact_exists=true (and does so before the step exits) so the gating condition works as intended.
|
|
||
| - name: Load Docker image | ||
| if: github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch' | ||
| if: (github.event_name == 'workflow_run' || github.event_name == 'workflow_dispatch') && steps.check-artifact.outputs.artifact_exists == 'true' |
There was a problem hiding this comment.
The workflow now gates downstream steps on steps.check-artifact.outputs.artifact_exists == 'true', but this diff only sets artifact_exists=false in the not-found branch. Unless artifact_exists=true is written to $GITHUB_OUTPUT in the found-artifact path elsewhere in this step, artifact_exists will be empty and both the download and load steps will be skipped even when the artifact exists. Ensure the found-artifact path sets artifact_exists=true (and does so before the step exits) so the gating condition works as intended.
✅ Supply Chain Verification Results✅ PASSED 📦 SBOM Summary
🔍 Vulnerability Scan
📎 Artifacts
Generated by Supply Chain Verification workflow • View Details |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Automated PR to propagate changes from main into development.
Triggered by push to main.