From 265695296ad244f99257a55d30db8eafbf1df134 Mon Sep 17 00:00:00 2001 From: Conrad Rockenhaus Date: Wed, 5 Aug 2026 05:19:52 -0500 Subject: [PATCH] fix(ci): run adversarial audit on Dependabot PRs Remove the dependabot[bot] author skip so every same-repo PR to main gets the K2.7 adversarial audit. Org Dependabot secrets now supply ADVERSARIAL_AUDIT_CF_API_TOKEN (and CF_AIG_TOKEN). PR comment is continue-on-error for Dependabot's read-only GITHUB_TOKEN. Files: .github/workflows/adversarial-audit.yml --- .github/workflows/adversarial-audit.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/adversarial-audit.yml b/.github/workflows/adversarial-audit.yml index e1abb60..1f1e4ed 100644 --- a/.github/workflows/adversarial-audit.yml +++ b/.github/workflows/adversarial-audit.yml @@ -61,14 +61,14 @@ concurrency: jobs: audit: - # Skip Dependabot by PR AUTHOR, not by github.actor (#420): actor is whoever - # triggered the latest run, so a human pushing one commit to a dependabot - # branch used to switch the full audit on for that branch. The author is a - # property of the PR and does not flip. + # Same-repo only (fork PRs never get org CF tokens). Dependabot is NOT + # skipped: policy is every PR to main runs the K2.7 audit. Dependabot- + # triggered runs read org *Dependabot* secrets (not Actions secrets) with + # the same names -- ADVERSARIAL_AUDIT_CF_API_TOKEN, CF_AIG_TOKEN -- seeded + # at org scope visibility=all. See fleet-chezmoi adversarial-audit-rollout.md. if: >- github.event_name == 'workflow_dispatch' || - (github.event.pull_request.head.repo.full_name == github.repository && - github.event.pull_request.user.login != 'dependabot[bot]') + github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest timeout-minutes: 30 env: @@ -133,6 +133,7 @@ jobs: - name: Post PR comment (advisory) if: github.event_name == 'pull_request' + continue-on-error: true env: GH_TOKEN: ${{ github.token }} PR_NUMBER: ${{ github.event.pull_request.number }}