Skip to content

fix(ci): route Dependabot PRs to develop, not main #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alain-sv merged 1 commit into from
May 13, 2026
Merged

fix(ci): route Dependabot PRs to develop, not main #40

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ version: 2
updates:
- package-ecosystem: "pip"
directory: "/"
target-branch: "develop"

@qodo-code-review qodo-code-review Bot May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Dependabot bypasses pr scan 🐞 Bug ⛨ Security

With Dependabot now targeting develop, dependency update PRs will no longer trigger the
OSV-Scanner workflow because security-scan.yml only runs for pull requests against main,
allowing dependency updates to merge without PR-time vulnerability scanning.
Agent Prompt 
### Issue description
Dependabot PRs are now opened against `develop`, but the OSV security scan workflow only triggers on PRs targeting `main`. This means dependency update PRs (the ones most likely to introduce vulnerable packages) won’t receive the intended PR-time OSV scan.

### Issue Context
- Dependabot is configured to target `develop`.
- The OSV security workflow’s `pull_request` trigger is restricted to `branches: [main]`.
- Repository documentation claims OSV-Scanner runs “on every PR”, which won’t hold for `develop`-targeted PRs.

### Fix Focus Areas
- .github/workflows/security-scan.yml[3-9]
- .github/dependabot.yml[3-8]
- SECURITY.md[19-32]

### Suggested change
Update `.github/workflows/security-scan.yml` so `on.pull_request.branches` includes `develop` (e.g., `[develop, main]`). If you intentionally only want to scan `main`, then update `SECURITY.md` to reflect that OSV-Scanner is not run on every PR and consider an alternate mechanism to scan `develop` dependency PRs.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

schedule:
interval: "weekly"
day: "monday"
Expand All @@ -21,6 +22,7 @@ updates:

- package-ecosystem: "github-actions"
directory: "/"
target-branch: "develop"
schedule:
interval: "weekly"
day: "monday"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/security-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ name: Security scan

on:
pull_request:
branches: [main]
branches: [main, develop]
push:
branches: [main]
branches: [main, develop]
schedule:
- cron: '23 6 * * *'

Expand Down
2 changes: 1 addition & 1 deletion SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,6 @@ This repository implements the following controls:
- Trusted Publishing (OIDC) for PyPI releases — no long-lived publish tokens
- Required reviewer approval on the `pypi` environment before publish secrets are exposed
- Third-party GitHub Actions pinned to commit SHAs
- OSV-Scanner in CI (daily + on every PR) against the OSV.dev malicious package index
- OSV-Scanner in CI (daily + on every PR targeting `main` or `develop`) against the OSV.dev malicious package index

If you observe a deviation from this posture, please report it via the private channel above.
Loading