mirror of
https://github.com/apache/airflow.git
synced 2026-11-04 07:12:48 +00:00
Jarek Potiuk
6acbc03bda
`dependency-review-action` has no path or manifest input. Once it runs it reviews the entire dependency graph diff of the PR, every lockfile included - so a gate named after one SDK can only ever be lying about what it covers. That is not theoretical. apache/airflow#72946, a release sync PR that changed 816 files and not one of them under `java-sdk/`, tripped the Java SDK gate through the self-reference in its own `paths` filter (v*-test and v*-stable keep different copies of every workflow file), and the Java SDK gate then failed on a Python advisory in `uv.lock`. Replace the two per-SDK review jobs with one `Dependency review` workflow covering the manifests of every ecosystem in the repo: * new `.github/workflows/dependency-review.yml`, triggered by any Python, JavaScript, Go or JVM manifest in the PR. * `java-sdk-dependency-security.yml` keeps only the Gradle `dependency-submission` job, which really is Java-specific, and drops its `pull_request` trigger. * `ts-sdk-dependency-review.yml` goes away - the generic gate already reviews `ts-sdk/package.json` and `ts-sdk/pnpm-lock.yaml`. The check name contributors see, `Reject vulnerable dependency changes`, is unchanged. The settings are the stricter of the two the repo had: the ts-sdk gate ran at the action's default `fail-on-scopes: runtime`, and now gets `runtime, development, unknown` like the java one. Generated-by: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01G9A6Mofr5qErDuTh7vqWcX