feat(automation): route trusted review-agent mentions #3148
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Keeps the upstream OSV base/head diff check available on every PR. The | |
| # central Security Scan workflow owns the blocking OSV result, finding logs, | |
| # and SARIF upload so this supplemental check does not duplicate installation | |
| # API calls or fail an otherwise clean PR when GitHub's upload quota is spent. | |
| name: OSV-Scanner PR | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review, closed] | |
| branches: [main, master, develop] | |
| concurrency: | |
| group: >- | |
| osv-scanner-pr-${{ | |
| github.event_name == 'pull_request' && github.event.pull_request.base.repo.full_name || github.repository }}-${{ | |
| github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| # Scorecard Token-Permissions (alert #41): keep the workflow-level token | |
| # read-only. SARIF upload needs security-events:write, but the osv-scan job | |
| # below already grants it at job scope, so it is redundant (and over-broad) | |
| # here. | |
| actions: read | |
| contents: read | |
| jobs: | |
| cancel-closed-pr-runs: | |
| if: github.event.action == 'closed' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: echo "PR closed; this run only cancels older runs through workflow concurrency." | |
| osv-scan: | |
| if: github.event.action != 'closed' | |
| # ponytail: use upstream reusable PR workflow, don't hand-roll the diff scan | |
| # Pinned to v2.3.8 + 1 commit (3a7550f) which gates the JSON job outputs | |
| # behind the new `export-results` input (default false). v2.3.8 dumped the | |
| # full old/new osv-scanner JSON into job outputs unconditionally, tripping | |
| # GitHub's 1,048,576-byte job-outputs cap and failing the run. Same nested | |
| # action pins as v2.3.8; only the Export step is now conditional. | |
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@3a7550f43ba5b58905a821ce3a0ed24c4858b3f4 # v2.3.8 + export-results gate | |
| permissions: | |
| actions: read | |
| contents: read | |
| # The pinned upstream reusable workflow declares this permission at its | |
| # top level, so GitHub validates it even when upload-sarif is false. | |
| security-events: write | |
| with: | |
| # Keep the PR code-scanning upload deterministic: direct manifest | |
| # vulnerabilities are uploaded, but public registry rate limits cannot | |
| # make the required upload check fail before SARIF reaches GitHub. | |
| # The security-scan workflow still performs the full base/head OSV pass | |
| # first and logs its --no-resolve fallback reason when registries are | |
| # transiently unavailable. | |
| scan-args: |- | |
| --maven-registry=https://maven-central.storage-download.googleapis.com/maven2 | |
| --no-resolve | |
| -r | |
| ./ | |
| # The required central security-scan.yml job uploads the comprehensive | |
| # current-head OSV SARIF. Avoid a second upload through the reusable | |
| # workflow because installation rate-limit failures are not findings. | |
| upload-sarif: false | |
| # Merge gating is done by central security-scan.yml with | |
| # --fail-on-vuln=true after printing package, version, OSV ID and aliases. | |
| fail-on-vuln: false |