This is an automated email from the ASF dual-hosted git repository.
amaechler pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 08ce0108050 Skip the OWASP dependency check on pull requests from
forks (#20820)
08ce0108050 is described below
commit 08ce01080503ea5960dd0532e0058023c8c6ef03
Author: Andreas Maechler <[email protected]>
AuthorDate: Mon Nov 2 21:28:01 2026 -0600
Skip the OWASP dependency check on pull requests from forks (#20820)
GitHub does not pass secrets to workflows triggered by pull requests from
forks, so NVD_API_KEY is empty and dependency-check fails with "Invalid API
Key, length of 0" followed by "No documents exist". Skip the job for those
pull requests instead of failing it; the nightly run still covers master.
---
.github/workflows/cron-job-its.yml | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/cron-job-its.yml
b/.github/workflows/cron-job-its.yml
index eb85273e611..1339d16bba1 100644
--- a/.github/workflows/cron-job-its.yml
+++ b/.github/workflows/cron-job-its.yml
@@ -35,7 +35,8 @@ concurrency:
jobs:
security_vulnerabilities:
- if: github.repository == 'apache/druid'
+ # Pull requests from forks get no secrets, and dependency-check fails
without an NVD API key.
+ if: github.repository == 'apache/druid' && (github.event_name !=
'pull_request' || github.event.pull_request.head.repo.full_name ==
github.repository)
name: security vulnerabilities
runs-on: ubuntu-24.04
steps:
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
