From 269084c7fb360044a654f16aff3483ebb111bc3d Mon Sep 17 00:00:00 2001 From: Noah Gift Date: Tue, 20 Oct 2026 15:32:02 +0200 Subject: [PATCH 1/2] sovereign-ci: SOV_ADVISORIES_DIFF_ONLY=1 skips non-diff advisory scans (default unchanged) Callers that gate advisories as a diff vs their base set it; every other caller is unaffected. Refs paiml/aprender#5792. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/sovereign-ci.yml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sovereign-ci.yml b/.github/workflows/sovereign-ci.yml index 3ded0d9..9949ea4 100644 --- a/.github/workflows/sovereign-ci.yml +++ b/.github/workflows/sovereign-ci.yml @@ -635,7 +635,13 @@ jobs: GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')" export GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 GIT_TERMINAL_PROMPT=0 if [ -f deny.toml ]; then - cargo deny check advisories licenses sources + # SOV_ADVISORIES_DIFF_ONLY=1: the caller judges advisories as a diff against its + # base (aprender PMAT-5792), so a main-resident advisory must not stop its PRs. + if [ "${SOV_ADVISORIES_DIFF_ONLY:-}" = 1 ]; then + cargo deny check licenses sources + else + cargo deny check advisories licenses sources + fi else echo "::warning::No deny.toml — skipping supply chain audit" fi @@ -1527,7 +1533,11 @@ jobs: fi fi - cargo audit $IGNORE_FLAGS + if [ "${SOV_ADVISORIES_DIFF_ONLY:-}" = 1 ]; then + echo "cargo audit skipped: the caller's diff gate is the scanner of record (SOV_ADVISORIES_DIFF_ONLY=1)" + else + cargo audit $IGNORE_FLAGS + fi # Symmetry with the container jobs (paiml/.github#42): every clean-room # job both tolerates poison on entry and refuses to leave any on exit, # so the invariant is uniform and greppable rather than per-job folklore. From 9078879912d106237a38137dee06be6ac6c04ac7 Mon Sep 17 00:00:00 2001 From: Noah Gift Date: Tue, 20 Oct 2026 16:32:41 +0200 Subject: [PATCH 2/2] sovereign-ci: advisories_diff_only input (default false) replaces env opt-in Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/sovereign-ci.yml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/workflows/sovereign-ci.yml b/.github/workflows/sovereign-ci.yml index 9949ea4..e834630 100644 --- a/.github/workflows/sovereign-ci.yml +++ b/.github/workflows/sovereign-ci.yml @@ -66,6 +66,14 @@ on: required: false default: 'always' type: string + advisories_diff_only: + description: >- + true: the caller judges advisories itself, as a diff against its base (aprender + PMAT-5792), so the plain `cargo deny check advisories` in `lint` and `cargo audit` + in `security` are skipped; licenses and sources still run. Default false: unchanged. + required: false + default: false + type: boolean run_benchmarks: description: 'Run criterion benchmarks (slow, use for nightly only)' required: false @@ -618,6 +626,7 @@ jobs: # the stricter check. env: GITHUB_TOKEN: ${{ github.token }} + SOV_ADVISORIES_DIFF_ONLY: ${{ inputs.advisories_diff_only }} run: | # forjar#422: the advisory-db clone is an anonymous git-over-HTTPS # fetch of a public repo, and GitHub answers the fleet's IP with 401 @@ -635,9 +644,9 @@ jobs: GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')" export GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 GIT_TERMINAL_PROMPT=0 if [ -f deny.toml ]; then - # SOV_ADVISORIES_DIFF_ONLY=1: the caller judges advisories as a diff against its + # advisories_diff_only: true: the caller judges advisories as a diff against its # base (aprender PMAT-5792), so a main-resident advisory must not stop its PRs. - if [ "${SOV_ADVISORIES_DIFF_ONLY:-}" = 1 ]; then + if [ "${SOV_ADVISORIES_DIFF_ONLY:-}" = true ]; then cargo deny check licenses sources else cargo deny check advisories licenses sources @@ -1493,6 +1502,7 @@ jobs: - name: Audit env: GITHUB_TOKEN: ${{ github.token }} + SOV_ADVISORIES_DIFF_ONLY: ${{ inputs.advisories_diff_only }} run: | # forjar#422: same throttle as the cargo-deny step — authenticate the # advisory-db fetch with the job's own token via a url rewrite. @@ -1533,8 +1543,8 @@ jobs: fi fi - if [ "${SOV_ADVISORIES_DIFF_ONLY:-}" = 1 ]; then - echo "cargo audit skipped: the caller's diff gate is the scanner of record (SOV_ADVISORIES_DIFF_ONLY=1)" + if [ "${SOV_ADVISORIES_DIFF_ONLY:-}" = true ]; then + echo "cargo audit skipped: the caller's diff gate is the scanner of record (advisories_diff_only: true)" else cargo audit $IGNORE_FLAGS fi