This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 6acbc03bdae Make dependency review one repo-wide gate, not a per-SDK
one (#73061)
6acbc03bdae is described below
commit 6acbc03bdae8993684c33a75b7941b42c577378a
Author: Jarek Potiuk <[email protected]>
AuthorDate: Sun Sep 13 14:49:23 2026 +0630
Make dependency review one repo-wide gate, not a per-SDK one (#73061)
`dependency-review-action` has no path or manifest input. Once it runs
it reviews the entire dependency graph diff of the PR, every lockfile
included - so a gate named after one SDK can only ever be lying about
what it covers.
That is not theoretical. apache/airflow#72946, a release sync PR that
changed 816 files and not one of them under `java-sdk/`, tripped the
Java SDK gate through the self-reference in its own `paths` filter
(v*-test and v*-stable keep different copies of every workflow file),
and the Java SDK gate then failed on a Python advisory in `uv.lock`.
Replace the two per-SDK review jobs with one `Dependency review`
workflow covering the manifests of every ecosystem in the repo:
* new `.github/workflows/dependency-review.yml`, triggered by any
Python, JavaScript, Go or JVM manifest in the PR.
* `java-sdk-dependency-security.yml` keeps only the Gradle
`dependency-submission` job, which really is Java-specific, and
drops its `pull_request` trigger.
* `ts-sdk-dependency-review.yml` goes away - the generic gate already
reviews `ts-sdk/package.json` and `ts-sdk/pnpm-lock.yaml`.
The check name contributors see, `Reject vulnerable dependency
changes`, is unchanged. The settings are the stricter of the two the
repo had: the ts-sdk gate ran at the action's default
`fail-on-scopes: runtime`, and now gets `runtime, development,
unknown` like the java one.
Generated-by: Claude Opus 5
Claude-Session: https://claude.ai/code/session_01G9A6Mofr5qErDuTh7vqWcX
---
.github/workflows/dependency-review.yml | 82 ++++++++++++++++++++++
.github/workflows/java-sdk-dependency-security.yml | 20 +-----
.github/workflows/ts-sdk-dependency-review.yml | 44 ------------
3 files changed, 83 insertions(+), 63 deletions(-)
diff --git a/.github/workflows/dependency-review.yml
b/.github/workflows/dependency-review.yml
new file mode 100644
index 00000000000..f21a71d64bc
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,82 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+---
+name: Dependency review
+
+# `dependency-review-action` has no way to limit itself to one ecosystem's
+# manifests: once it runs it reviews the whole dependency graph diff of the PR,
+# every lockfile included. So this is one repo-wide gate rather than a per-SDK
+# one - a per-SDK gate would only be lying about what it covers, and would fail
+# on another ecosystem's advisory under a name that points at the wrong team.
+#
+# Keep the `paths` list below in step with the manifests the repo actually has:
+# a dependency file that is not listed here is never reviewed.
+
+on: # yamllint disable-line rule:truthy
+ pull_request:
+ paths:
+ # Python
+ - "uv.lock"
+ - "**/uv.lock"
+ - "pyproject.toml"
+ - "**/pyproject.toml"
+ - "**/requirements*.txt"
+ # JavaScript / TypeScript
+ - "**/package.json"
+ - "**/pnpm-lock.yaml"
+ - "**/package-lock.json"
+ - "**/yarn.lock"
+ # Go
+ - "**/go.mod"
+ - "**/go.sum"
+ # Java / Kotlin / Scala
+ - "**/*.gradle"
+ - "**/*.gradle.kts"
+ - "**/gradle/libs.versions.toml"
+ - "**/gradle.lockfile"
+ - "**/pom.xml"
+ # This workflow
+ - ".github/workflows/dependency-review.yml"
+
+permissions:
+ contents: read
+
+concurrency:
+ group: dependency-review-${{ github.event.pull_request.number || github.ref
}}
+ cancel-in-progress: true
+
+jobs:
+ dependency-review:
+ name: Reject vulnerable dependency changes
+ runs-on: ubuntu-slim
+ steps:
+ - name: Review dependency changes
+ uses:
actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 #
v5.0.0
+ with:
+ fail-on-severity: high
+ fail-on-scopes: runtime, development, unknown
+ show-openssf-scorecard: true
+ show-patched-versions: true
+ # GHSA-8mgp-746c-j5xp / CVE-2026-81726 - path traversal in nltk's
+ # model-artifact save/load APIs, no released fix yet. nltk is a
CI-only
+ # transitive dependency (llama-index-core, pulled by the common.ai
+ # provider's "llamaindex" extra); it is not in the released
constraints
+ # and none of the affected APIs are reachable from llama-index-core,
+ # which only uses the Punkt tokenizer and the stopwords corpus. The
fix
+ # is merged on nltk's develop branch (nltk/nltk#3757, #3759, #3813)
and
+ # is waiting on a 3.10.4 release - drop this entry once that ships.
+ allow-ghsas: GHSA-8mgp-746c-j5xp
diff --git a/.github/workflows/java-sdk-dependency-security.yml
b/.github/workflows/java-sdk-dependency-security.yml
index 805ca491628..ca74a6dd2b1 100644
--- a/.github/workflows/java-sdk-dependency-security.yml
+++ b/.github/workflows/java-sdk-dependency-security.yml
@@ -18,10 +18,6 @@
name: Java SDK dependency security
on: # yamllint disable-line rule:truthy
- pull_request:
- paths:
- - "java-sdk/**"
- - ".github/workflows/java-sdk-dependency-security.yml"
push:
branches:
- main
@@ -36,25 +32,11 @@ permissions:
concurrency:
group: java-sdk-dependency-security-${{ github.event_name }}-${{ github.ref
}}
- cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+ cancel-in-progress: false
jobs:
- dependency-review:
- name: Reject vulnerable dependency changes
- if: github.event_name == 'pull_request'
- runs-on: ubuntu-slim
- steps:
- - name: Review dependency changes
- uses:
actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 #
v5.0.0
- with:
- fail-on-severity: high
- fail-on-scopes: runtime, development, unknown
- show-openssf-scorecard: true
- show-patched-versions: true
-
dependency-submission:
name: Submit resolved Gradle dependencies
- if: github.event_name != 'pull_request'
runs-on: ubuntu-latest
permissions:
contents: write
diff --git a/.github/workflows/ts-sdk-dependency-review.yml
b/.github/workflows/ts-sdk-dependency-review.yml
deleted file mode 100644
index 37bcdb9c814..00000000000
--- a/.github/workflows/ts-sdk-dependency-review.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
----
-name: TypeScript SDK dependency review
-
-on: # yamllint disable-line rule:truthy
- pull_request:
- branches:
- - main
- paths:
- - "ts-sdk/package.json"
- - "ts-sdk/pnpm-lock.yaml"
- - ".github/workflows/ts-sdk-dependency-review.yml"
-
-permissions:
- contents: read
-
-concurrency:
- group: ts-sdk-dependency-review-${{ github.event.pull_request.number ||
github.ref }}
- cancel-in-progress: true
-
-jobs:
- dependency-review:
- name: Reject vulnerable dependency changes
- runs-on: ubuntu-slim
- steps:
- - name: Review dependency changes
- uses:
actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 #
v5.0.0
- with:
- fail-on-severity: high
