chore(ci): 1/3 stack — pin refresh + license allow-list - #217
Conversation
Replace the overlapping #212/#213/#215/#216 siblings with a single bottom-of-stack commit: l9-ci-core pins to 0d28395, upload-artifact v7.0.1, and SPDX AND expressions on the license allow-list fallback so the observability layer can pass Dependency Review. Co-authored-by: Cursor <cursoragent@cursor.com>
|
✅ PR reviewable size is within recommended limits |
L9 Audit Harness Report
Step Results
Architecture Audit Findings
See Spec Coverage
See Next StepsAll checks passed. Safe to merge. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Upload reports | ||
| if: always() | ||
| uses: actions/upload-artifact@v7 | ||
| uses: actions/upload-artifact@v7.0.1 |
|
|
||
| - name: Upload Scorecard Results as Artifact | ||
| uses: actions/upload-artifact@v7 | ||
| uses: actions/upload-artifact@v7.0.1 |
| - name: Upload License Report | ||
| if: always() | ||
| uses: actions/upload-artifact@v7 | ||
| uses: actions/upload-artifact@v7.0.1 |
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c305ccdec9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # dependency-review-action rejects specifying both allow-licenses and | ||
| # deny-licenses. Keep the allow-list (stricter); deny-list is implied. | ||
| allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC' }} | ||
| allow-licenses: ${{ vars.ALLOWED_LICENSES || 'MIT, Apache-2.0, BSD-3-Clause, BSD-2-Clause, ISC, Apache-2.0 AND MIT, Apache-2.0 AND BSD-2-Clause' }} |
There was a problem hiding this comment.
When ALLOWED_LICENSES has been provisioned from .github/env.template, that nonempty repository variable takes precedence over this fallback, but the template at .github/env.template:199-201 still contains the old list. In that configuration, dependencies reporting either new compound SPDX expression remain rejected, so this change does not achieve its stated purpose; update the template/configured default alongside the fallback.
Useful? React with 👍 / 👎.
|
Superseded by #220 — compatible sdk-revision (b1a49141), SPDX AND licenses appended despite repo ALLOWED_LICENSES, Poetry+requirements.txt observability, attest v4.2.2. Closing this stack PR. |
|
Closed in favor of #220. |
2 participants
Summary
Bottom of a 3-PR stack that replaces overlapping Dependabot siblings #212 #213 #215 #216.
l9-ci-coreprovision-sdk,publish-analysis.yml, andbaseline-ratchet.ymlto0d28395upload-artifactto v7.0.1 (l9-analysis.ymlhash pin;audit.yml/supply-chain.ymltag)ANDexpressions so layer 2 can passMerge this first (oldest / bottom). While child PRs are open, merge with a merge commit — do not squash this parent.
Stack
mainattest-build-provenancev4.2.2 → deps branchTest plan
Made with Cursor