imbajin opened a new pull request, #3326: URL: https://github.com/apache/hugegraph/pull/3326
Dependency review needs a matching master inventory in each repository. Automatic PR submissions and snapshots in the test fork cannot supply the ASF baseline. Add a dedicated master producer for Apache and the designated HugeGraph test fork. Each repository receives its own inventory. Only trusted master push/dispatch events reach the write job; PRs, other forks and other refs remain read-only. Checkout and current-master guards bind the inventory to the event revision, with privileged actions pinned. Validation: actionlint, existing CI policy and dependency-inventory tests, event/permission and stale-revision controls passed. The pinned official parser read the reactor reports; three independent reviews and the org CI passed. Reviewed manual master snapshots have been submitted to each repository. Continuous production still requires this workflow to enter each master and complete its first run. The existing Spring security issue remains open. See docs/ci.md for scope and acceptance checks. Org validation: https://github.com/hugegraph/hugegraph/pull/300 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
