FrankChen021 commented on code in PR #20820: URL: https://github.com/apache/druid/pull/20820#discussion_r4449710726
########## .github/workflows/cron-job-its.yml: ########## @@ -35,7 +35,8 @@ concurrency: jobs: security_vulnerabilities: - if: github.repository == 'apache/druid' + # Pull requests from forks get no secrets, and dependency-check fails without an NVD API key. + if: github.repository == 'apache/druid' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) Review Comment: [P2] Dependabot PRs still run without Actions secrets **Finding:** This guard only treats a pull request as untrusted when its head repository differs from apache/druid. Dependabot PRs in this repository can have the same head repository, but GitHub runs Dependabot-triggered pull_request workflows with fork-like restrictions and does not expose Actions secrets. If such a PR changes owasp-dependency-check-suppressions.xml, this condition is true and the job reaches the Maven check with an empty NVD_API_KEY, preserving the failure this change is meant to avoid. **Suggestion:** Also exclude Dependabot-authored pull_request events from this job, or provide the required Dependabot secrets, and cover that path in the workflow’s validation or documentation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
