amaechler commented on code in PR #20820: URL: https://github.com/apache/druid/pull/20820#discussion_r4450613039
########## .github/workflows/cron-job-its.yml: ########## @@ -35,7 +35,8 @@ concurrency: jobs: security_vulnerabilities: - if: github.repository == 'apache/druid' + # Pull requests from forks get no secrets, and dependency-check fails without an NVD API key. + if: github.repository == 'apache/druid' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) Review Comment: Dependabot never edits `owasp-dependency-check-suppressions.xml`, so a Dependabot-triggered `pull_request` run can't reach this job through the path filter. The only Dependabot PR that touched the file was #20657, where the suppression change was a maintainer commit pushed to the Dependabot branch. That run had `NVD_API_KEY` (it got past the NVD download and failed on the jackson CVEs, run 40661592591), because GitHub uses the pushing user as the actor in that case. So I'd leave the condition as is. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
