Repository navigation
P3: evaluate CodeQL/dependency-review/Dependabot — decline all three (roadmap Low) - #337
Merged
Merged
Conversation
…(roadmap Low) Works the final P3 roadmap item — "Evaluate CodeQL / dependency-review / Dependabot given the small dependency surface". Documentation-only decision; declines all three, each for a distinct verified reason: - Dependabot: redundant with the already-configured Renovate (renovate.json extends the org preset); running both mints duplicate PRs. - CodeQL: F# is unsupported (can't scan Game.Core/Game.Render); its actions mode overlaps the existing SHA-pin + actionlint/shellcheck posture. - dependency-review: the right control, but BLOCKED on an org-owned prerequisite. Built the gate (SHA-pinned dependency-review-action@v5.0.0, contents:read, fail-on-severity:high) and it was correct — actionlint green — but it fails at runtime: "Dependency graph is not enabled." Verified this is org/enterprise-level, not repo-settable: the dependency-graph compare API 403s, a repo-admin PATCH silently drops the dependency_graph key, and no FS-GG repo uses dependency-review. Enabling the Dependency Graph is an FS-GG org security-settings decision — the same upstream-owned boundary class this roadmap already deferred (the @main reusable workflows, the DO-NOT-EDIT props comment). For a Low item on a tiny all-public lockfile-pinned surface already under Renovate's vulnerability alerts, driving that org change isn't warranted, so it is flagged upstream, not forced here. The ready-to-adopt workflow is preserved verbatim in the roadmap for the day the org enables it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
EHotwagner
force-pushed
the
p3-dependency-review-gate
branch
from
July 15, 2026 10:43
4169d07 to
8784b1e
Compare
EHotwagner
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Works the final P3 roadmap item in
docs/reports/2026-07-15-code-and-architecture-review.md— the review's §5 gap "No CodeQL / dependency-review / Dependabot", framed as "Evaluate ... given the small dependency surface." Documentation-only decision: decline all three, each for a distinct, verified reason.Why this ended as a decline, not an add
I first built and pushed the one genuine candidate — a SHA-pinned
dependency-reviewgate — and it passed local + CI actionlint. But it failed at runtime:I then verified the blocker is org/enterprise-level, not a repo toggle:
GET /repos/FS-GG/FS.GG.Game/dependency-graph/compare/{base}...{head}→ 403 ForbiddenPATCH … security_and_analysis[dependency_graph][status]=enabled→ accepted (200) but silently drops the key (not repo-settable)dependency-review-action→ the Dependency Graph is off org-wideEnabling the Dependency Graph is an FS-GG org security-settings decision (
github.com/organizations/FS-GG/settings/security_analysis) — the same upstream-owned-boundary class this roadmap already deferred (the@mainreusable workflows; the DO-NOT-EDITDirectory.Build.propscomment). Rather than merge a gate that 403s red on every PR, I removed it and preserved it verbatim in the roadmap as a drop-in for the day the org enables the graph.Decision
renovate.jsonextends the org preset: version bumps + dependency dashboard + vulnerability alerts). Running both mints duplicate PRs.Game.Core/Game.Render. Itsactionsmode overlaps the existing SHA-pin (#335) + checksum-pinned actionlint/shellcheck posture.Follow-up (org-owned, not code)
If the FS-GG org enables the Dependency Graph in its security settings, adopting the gate is a ~5-minute drop-in of the workflow preserved in the roadmap. Not driven from this repo at Low priority.
🤖 Generated with Claude Code