fix(ci): dependency-review 가용성 가드 — 실패 알림 메일 차단#306
Merged
Conversation
valkey 의 dependency-review.yml 이 가드 없이 dependency-review-action 을 무조건 실행 → GitHub Dependency graph 미가용(org-level) repo 에서 "not supported" 로 job 실패 → PR마다 GitHub Actions 실패 알림 메일 발송. mongodb-operator 가 이미 적용한 "Check dependency graph availability" 가드 스텝을 이식: dependency-graph/sbom API 조회로 가용성 확인 → 미가용 시 ::notice:: 후 review 스텝 skip(if: supported==true) → job PASS. 양 repo 워크플로우 동일화. 검증: mongo 동일 워크플로우가 이미 PASS (가드로 graceful skip). diff 0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: phil <phil@keiailab.com>
백그라운드 보안 리뷰의 "fail-open" 우려 정식 처리 — 가드의 의도적 tradeoff 를 주석으로 문서화: - graph 가용 시 review 는 그대로 차단 게이트(fail-closed, if: supported==true). - graph 미가용 시 action 은 review 전 hard-error(게이트 부작동 + 메일만) → skip. - CVE 차단은 graph 불요인 govulncheck(security-scan.yml)가 fail-closed backstop 상시 enforce. 즉 보안 게이트 손실 없이 실패 알림 메일만 제거. 동작 변경 없음(주석만). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: phil <phil@keiailab.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
문제
valkey
dependency-review.yml이 가드 없이 action 무조건 실행 → Dependency graph 미가용 repo 에서 "not supported" 실패 → PR마다 실패 알림 메일.수정
mongodb-operator 가 이미 적용한 "Check dependency graph availability" 가드 스텝 이식 — 미가용 시
::notice::후 review skip(if: supported=='true') → job PASS. 양 repo 워크플로우 동일화 (diff 0).mongo 동일 워크플로우가 이미 green(가드로 graceful skip) → 검증된 패턴.
🤖 Generated with Claude Code