Conversation
Implement the first slice of the CI concept (phase 2): the DASH license check moves to the trusted chain, removing the pull_request_target trigger it used before for fork PRs. Trusted jobs get two entry points (ADR 0001): a direct call from on-pr.yml for repository PRs, merge group and pushes, and a thin workflow_run listener for forks, gated by the approved-for-ci label. The gate validates the label against the PR timeline so any push after labelling invalidates it; rejected runs skip with an explanatory PR comment instead of failing.
umaucher
requested review from
PandaeDo,
antonkri and
vinodreddy-g
as code owners
September 14, 2026 13:52
The DASH tool accepts runs without -token (anonymous access to the public license databases) but rejects -token with an empty value. Passing the flag unconditionally made the license check fail with a usage error whenever the secret was not configured. The flag is now only added when a token is present.
The DASH tool requires -review to be combined with a token; in anonymous mode it is a usage error. Without a token the check now runs against the public license data without -review, exiting 0 while still reporting items needing review.
Match the upstream cicd-workflows behavior: the DASH tool exits non-zero when content requires review, which is an expected outcome and not a job failure. The step now captures the tool's output and exit code, echoes both into the job summary, and succeeds; only a genuine invocation error would still surface as a red job.
janis-qorix
approved these changes
Sep 15, 2026
janis-qorix
suggested changes
Sep 15, 2026
janis-qorix
left a comment
janis-qorix
left a comment
There was a problem hiding this comment.
Please fix documentation build errors
umaucher
marked this pull request as draft
September 15, 2026 15:45
Contributor
Author
|
might get obsolete with eclipse-score/cicd-workflows#235 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the first slice of phase 2 of the CI concept (#420): the DASH license check moves to the trusted chain. Doc clarifications (trigger matrix, secrets inventory) are handled in #420.
Supersedes #422 (same commits, now from a repository branch so the new direct license-check path runs in this PR).
Changes
license_check.yml(which used the bannedpull_request_targettrigger for forks) is replaced by:license_check_core.yml: reusable DASH check core with explicit head-SHA checkout for the fork pathtrusted_chain_gate.yml: reusableapproved-for-cifork gate — label must be present and nosynchronize/head_ref_force_pushedtimeline event after it (any push invalidates); rejects skip with an explanatory PR comment instead of failinglicense_check_forks.yml: thinworkflow_runlistener wiring gate + core for fork PRs onlyon-pr.ymlcalls the core directly for repository PRs,merge_groupandpush(ADR 0001: two entry points, one core)Notes for reviewers
approved-for-cilabel to codeowners.checkoutv7.0.1,setup-bazel0.19.0,create-or-update-commentv5.0.0, bazelisk 1.29.0).