potiuk opened a new pull request, #73061: URL: https://github.com/apache/airflow/pull/73061
`dependency-review-action` has no path or manifest input. Once it runs it reviews the entire dependency graph diff of the PR, every lockfile included — so a gate named after one SDK can only ever be lying about what it covers. That is not theoretical. #72946, a release sync PR that changed 816 files and not one of them under `java-sdk/`, tripped the Java SDK gate through the self-reference in its own `paths` filter (`v*-test` and `v*-stable` keep different copies of every workflow file), and the Java SDK gate then failed on a Python advisory in `uv.lock`. Replace the two per-SDK review jobs with one `Dependency review` workflow covering the manifests of every ecosystem in the repo: * new `.github/workflows/dependency-review.yml`, triggered by any Python, JavaScript, Go or JVM manifest in the PR; * `java-sdk-dependency-security.yml` keeps only the Gradle `dependency-submission` job, which really is Java-specific, and drops its `pull_request` trigger; * `ts-sdk-dependency-review.yml` goes away — the generic gate already reviews `ts-sdk/package.json` and `ts-sdk/pnpm-lock.yaml`. The check name contributors see, `Reject vulnerable dependency changes`, is unchanged. The settings are the stricter of the two the repo had: the ts-sdk gate ran at the action's default `fail-on-scopes: runtime`, and now gets `runtime, development, unknown` like the java one. Note for review: the `paths` list is the coverage boundary — a dependency file not listed there is never reviewed. Root-level manifests are listed both bare and under `**/`, because GitHub's `**` matches zero or more characters including `/` and so would not match a repo-root `uv.lock` on its own. Follow-up to #73059, which suppresses the nltk advisory itself. The `allow-ghsas` entry moves into the new workflow here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01G9A6Mofr5qErDuTh7vqWcX -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
