From 4f24f1a16f485db1e718bdcae2135b6384e541f6 Mon Sep 17 00:00:00 2001 From: Mike Date: Tue, 1 Sep 2026 13:12:31 -0700 Subject: [PATCH] ci: bump security report action to v4.1.0 and surface its failures v4.1.0 drops the `dependencies` expansion from the dependency-graph GraphQL query, which was returning `timedout` and stalling the CodeQL job, and reads the package list from the SBOM REST API instead. Drop `continue-on-error` from the report step so genuine failures are visible rather than being rewritten to a success conclusion. Guard the step for the two cases where SECURITY_TOKEN is unreachable and the action fails on an empty input: pull requests from forks, and Dependabot runs, which read a separate secret store. Gate the rename and upload steps on the report step's own outcome, since a skipped step does not stop the steps after it and `mv` would error on a file that was never created. Claude-Session: https://claude.ai/code/session_01VivkdrFB8x5pEWnxmM6gMm --- .github/workflows/codeql-analysis.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index e9e20ebf..657eba5e 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -84,18 +84,25 @@ jobs: - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3.29.5 - name: Generate Security Report - uses: rsdmike/github-security-report-action@1df22b1e0a7e15b32f728ccf7bab259e46c80589 # v4.0.1 - continue-on-error: true + id: security_report + # SECURITY_TOKEN is not available to fork PRs or Dependabot runs; an empty token fails the step. + if: >- + github.actor != 'dependabot[bot]' && + (github.event_name != 'pull_request' || + github.event.pull_request.head.repo.full_name == github.repository) + uses: rsdmike/github-security-report-action@a3d8cc051bc89f1b622d396adab901aa73857a29 # v4.1.0 with: template: report token: ${{ secrets.SECURITY_TOKEN }} - name: Rename Report + if: steps.security_report.outcome == 'success' shell: bash continue-on-error: true run: | DATE=$(date +"%Y-%m-%d") mv "report.pdf" "ui-toolkit-security-report-$DATE.pdf" - name: GitHub Upload Release Artifacts + if: steps.security_report.outcome == 'success' uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 continue-on-error: true with: