Run PR CVE gate on every PR so it can serve as a required check#9
Merged
Conversation
The workflow had a paths filter restricting it to docker-compose.yml changes only. With branch protection now requiring the 'scan' check on main, any PR that doesn't touch compose (workflow updates, renovate config, README edits, GitHub Action version bumps) was blocked at "Expected — Waiting for status to be reported" and needed admin bypass. The detect step already writes no_compose_changes=true and every downstream step is gated by `if: steps.changed.outputs.no_compose_changes != 'true'`, so removing the paths filter is safe: non-compose PRs run the detect step (~5s) and pass, compose PRs scan as before.
Contributor
CVE deltaNo changes. Every image's CVE set is identical to the previous scan. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
paths:filter from.github/workflows/pr-cve-gate.ymlso the workflow runs on every PR.Detect changed compose filesstep writesno_compose_changes=truewhen no compose file changed, and every downstream step (install Trivy, scan, post comment) is already gated byif: steps.changed.outputs.no_compose_changes != 'true'. Non-compose PRs now run the detect step (~5s) and thescanjob succeeds trivially.Why
Branch protection on
mainnow requires thescanstatus check. With the previouspaths:filter, PRs that don't touch compose (workflow bumps,renovate.jsonmigrations, README edits) never triggered the workflow, so the check sat at "Expected — Waiting for status to be reported" and the PR couldn't merge without admin bypass.After this lands, all non-Docker PRs pass the gate naturally and no bypass is needed — including the open Renovate config-migration PR (#5) and the incoming Node-24 action majors (
actions/checkoutv6,actions/cachev5,marocchino/sticky-pull-request-commentv3).Test plan
paths:match — that's the test).scancheck should now show ✅ without manual intervention.Merge note
This PR itself needs an admin bypass to merge (it's a chicken-and-egg PR — it can't satisfy the rule it's about to fix). After merge, no future PR will need bypass for this reason.