luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 16: CI dependency audit & security checks #15

Merged
luckberg merged 40 commits from gsd/phase-16-ci-dependency-audit-and-security-checks into main 2026-06-13 10:01:01 -04:00
Conversation 0 Commits 40 Files Changed 42
+8 -1
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit f0f7d8a9f4 - Show all commits
.gitea/workflows/ci.yml
+8 -1
View File
@@ -420,7 +420,7 @@ jobs:
gate: gate:
runs-on: ubuntu-latest runs-on: ubuntu-latest
needs: [fast-checks, changes, api, harness] needs: [fast-checks, changes, api, harness, security]
if: always() if: always()
steps: steps:
- name: Check all required jobs passed or were skipped - name: Check all required jobs passed or were skipped
@@ -430,6 +430,13 @@ jobs:
echo "fast-checks: ${{ needs.fast-checks.result }}" echo "fast-checks: ${{ needs.fast-checks.result }}"
exit 1 exit 1
fi fi
# security always runs (gitleaks fires on every PR, D-12) — must be success.
# NOT folded into the success-or-skipped loop below — security can never be skipped.
# NOTE: individual needs.X.result check (not wildcard) due to Gitea #31007.
if [ "${{ needs.security.result }}" != "success" ]; then
echo "security: ${{ needs.security.result }}"
exit 1
fi
# api and harness are conditionally skipped — success OR skipped are both acceptable # api and harness are conditionally skipped — success OR skipped are both acceptable
# NOTE: uses individual needs.X.result checks (not the wildcard aggregate) due to # NOTE: uses individual needs.X.result checks (not the wildcard aggregate) due to
# Gitea 1.26.2 bug #31007 where the wildcard expression returns false even when jobs succeed. # Gitea 1.26.2 bug #31007 where the wildcard expression returns false even when jobs succeed.