From 84d7e748933866271f759f490e0a35c91003c85c Mon Sep 17 00:00:00 2001 From: Mike Date: Tue, 1 Sep 2026 13:12:34 -0700 Subject: [PATCH] ci: bump security report action to v4.1.0 and surface its failures v4.1.0 drops the `dependencies` expansion from the dependency-graph GraphQL query, which was returning `timedout` and stalling the CodeQL job, and reads the package list from the SBOM REST API instead. Drop `continue-on-error` from the report step so genuine failures are visible rather than being rewritten to a success conclusion. Guard the step for the two cases where SECURITY_TOKEN is unreachable and the action fails on an empty input: pull requests from forks, and Dependabot runs, which read a separate secret store. Gate the rename and upload steps on the report step's own outcome, since a skipped step does not stop the steps after it and `mv` would error on a file that was never created. Claude-Session: https://claude.ai/code/session_01VivkdrFB8x5pEWnxmM6gMm --- .github/workflows/codeql-analysis.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index e9bbc8971..421184199 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -84,18 +84,25 @@ jobs: - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 - name: Generate Security Report - uses: rsdmike/github-security-report-action@1df22b1e0a7e15b32f728ccf7bab259e46c80589 # v4.0.1 - continue-on-error: true + id: security_report + # SECURITY_TOKEN is not available to fork PRs or Dependabot runs; an empty token fails the step. + if: >- + github.actor != 'dependabot[bot]' && + (github.event_name != 'pull_request' || + github.event.pull_request.head.repo.full_name == github.repository) + uses: rsdmike/github-security-report-action@a3d8cc051bc89f1b622d396adab901aa73857a29 # v4.1.0 with: template: report token: ${{ secrets.SECURITY_TOKEN }} - name: Rename Report + if: steps.security_report.outcome == 'success' shell: bash continue-on-error: true run: | DATE=$(date +"%Y-%m-%d") mv "report.pdf" "mps-security-report-$DATE.pdf" - name: GitHub Upload Release Artifacts + if: steps.security_report.outcome == 'success' uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 continue-on-error: true with: