Skip to content

sovereign-ci: SOV_ADVISORIES_DIFF_ONLY opt-out of non-diff advisory scans #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
noahgift merged 2 commits into from
Oct 22, 2026
+22 −2
Merged

sovereign-ci: SOV_ADVISORIES_DIFF_ONLY opt-out of non-diff advisory scans #86

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
269084c
sovereign-ci: SOV_ADVISORIES_DIFF_ONLY=1 skips non-diff advisory scan…
noahgift Oct 20, 2026
9078879
sovereign-ci: advisories_diff_only input (default false) replaces env…
noahgift Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 22 additions & 2 deletions .github/workflows/sovereign-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,14 @@ on:
required: false
default: 'always'
type: string
advisories_diff_only:
description: >-
true: the caller judges advisories itself, as a diff against its base (aprender
PMAT-5792), so the plain `cargo deny check advisories` in `lint` and `cargo audit`
in `security` are skipped; licenses and sources still run. Default false: unchanged.
required: false
default: false
type: boolean
run_benchmarks:
description: 'Run criterion benchmarks (slow, use for nightly only)'
required: false
Expand Down Expand Up @@ -618,6 +626,7 @@ jobs:
# the stricter check.
env:
GITHUB_TOKEN: ${{ github.token }}
SOV_ADVISORIES_DIFF_ONLY: ${{ inputs.advisories_diff_only }}
run: |
# forjar#422: the advisory-db clone is an anonymous git-over-HTTPS
# fetch of a public repo, and GitHub answers the fleet's IP with 401
Expand All @@ -635,7 +644,13 @@ jobs:
GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
export GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 GIT_TERMINAL_PROMPT=0
if [ -f deny.toml ]; then
cargo deny check advisories licenses sources
# advisories_diff_only: true: the caller judges advisories as a diff against its
# base (aprender PMAT-5792), so a main-resident advisory must not stop its PRs.
if [ "${SOV_ADVISORIES_DIFF_ONLY:-}" = true ]; then
cargo deny check licenses sources
else
cargo deny check advisories licenses sources
fi
else
echo "::warning::No deny.toml — skipping supply chain audit"
fi
Expand Down Expand Up @@ -1487,6 +1502,7 @@ jobs:
- name: Audit
env:
GITHUB_TOKEN: ${{ github.token }}
SOV_ADVISORIES_DIFF_ONLY: ${{ inputs.advisories_diff_only }}
run: |
# forjar#422: same throttle as the cargo-deny step — authenticate the
# advisory-db fetch with the job's own token via a url rewrite.
Expand Down Expand Up @@ -1527,7 +1543,11 @@ jobs:
fi
fi

cargo audit $IGNORE_FLAGS
if [ "${SOV_ADVISORIES_DIFF_ONLY:-}" = true ]; then
echo "cargo audit skipped: the caller's diff gate is the scanner of record (advisories_diff_only: true)"
else
cargo audit $IGNORE_FLAGS
fi
# Symmetry with the container jobs (paiml/.github#42): every clean-room
# job both tolerates poison on entry and refuses to leave any on exit,
# so the invariant is uniform and greppable rather than per-job folklore.
Expand Down
Loading