From 1b3e8045eb984b2fe9c06a901636b5b73479da43 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Tue, 8 Sep 2026 11:25:23 +0200 Subject: [PATCH] ci: do not fail-fast the release build matrix Each release line is built and Trivy-scanned against its own oCIS binary, so a finding on one line says nothing about the others. With fail-fast at its default, the first failing leg cancels the remaining ones mid-build and their real status is never reported. This is not hypothetical: the 8.1.0 leg has been failing its Trivy gate since 2026-09-02, which cancelled the 8.2.0 and 8.0.8 legs in every run since. The 8.2.0 line turns out to be affected by the same three advisories (its go.mod pins golang.org/x/crypto v0.54.0, golang.org/x/image v0.44.0 and google.golang.org/grpc v1.82.1), and that went unnoticed for a week purely because the leg never reached its scan. Tracked upstream as owncloud/ocis#12903 for 8.2 and owncloud/ocis#12810 for 8.1. This does not make CI green -- it makes it truthful. Co-Authored-By: Claude Opus 5 --- .github/workflows/main.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index abf9d38..be1b128 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -49,6 +49,10 @@ jobs: docker-hub-password: ${{ secrets.DOCKERHUB_TOKEN }} strategy: + # Each release line is scanned against its own binary, so one line's Trivy + # findings say nothing about the others. With the default fail-fast the first + # red leg cancels the rest mid-build, hiding whether they would have passed. + fail-fast: false matrix: release: # `latest` must always stay on the newest stable release entry