ci: report dependency advisories without blocking merges by zoeyrose · Pull Request #13 · atrinik/deploy-control

zoeyrose · 2026-10-12T02:01:03Z

Summary

Dependency review reports dependency advisories for the Codex implementer before merge without making findings a CI barrier.

Implementation / behavior

Preserve the official pinned action and review runtime, development, and unknown scopes at low severity with warn-only: true.
Always request a PR comment and retain the job summary when fork or Dependabot permissions prevent comments. The pinned action catches comment errors as warnings.
Set step continue-on-error: true so operational errors remain visible in logs without blocking CI; a green job does not prove a clean dependency review.
Retain advisory license checks and preserve scorecard and snapshot retry settings. Run on eligible ordinary pull requests where the workflow exists, without a target-branch filter; merge-queue events are excluded. Cancel superseded per-PR runs, and publish an unknown-result summary and refresh the action-owned PR comment with the exact head/run link when the action's raw outcome is failure. The reporter validates repository, comment ownership/pagination and current PR head; permission or API failures leave visible summary warnings. The action/reporter have 5/2-minute timeboxes within the 10-minute job. License metadata does not certify compatibility; existing repository license rules still apply. Keep CodeQL, existing CI, and npm audit regression behavior unchanged.
Instruct the Codex implementer to read the latest current-HEAD job summary even when a PR comment exists, fix actionable introduced risk, or record explicit maintainer acceptance of existing risk before merge. No allowlists, catalog requirement, or additional human approval gate is added.

Validation

Focused actionlint, whitespace, advisory contract, Python compilation, canonical reporter equality, and exact source hash checks passed. Canonical reporter fixtures and independent security/source reviews passed.
Independent review approved the exact two-file patch and reviewed the pinned action's warning and summary fallback behavior.
Live PR CI and Codex review results remain pending.

Limitations / follow-up

The coordinator will check this PR's exact head and base, live CI, advisory evidence, and review findings before considering merge.

github-actions · 2026-10-12T02:01:13Z

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

zoeyrose · 2026-10-12T02:02:18Z

@codex review

zoeyrose · 2026-10-12T02:02:20Z

@codex security review

chatgpt-codex-connector · 2026-10-12T02:02:32Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T05:01:49.227531Z	`a9179d1`	Manual request
🔒 Security Review	✅ Completed 2026-10-12T05:02:29.730869Z	`a9179d1`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-12T02:03:59Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: f25f58d393

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T02:04:13Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: f25f58d393

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T02:29:32Z

@codex review

zoeyrose · 2026-10-12T02:29:34Z

@codex security review

chatgpt-codex-connector · 2026-10-12T02:32:09Z

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 82fe1b052a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T02:32:25Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 82fe1b052a

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T02:55:56Z

@codex review

zoeyrose · 2026-10-12T02:56:00Z

@codex security review

chatgpt-codex-connector · 2026-10-12T02:57:52Z

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 43857de4c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T02:59:39Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 43857de4c6

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T03:32:43Z

@codex review

zoeyrose · 2026-10-12T03:32:48Z

@codex security review

chatgpt-codex-connector · 2026-10-12T03:35:31Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: b57a958a77

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b57a958a77

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

zoeyrose · 2026-10-12T04:05:15Z

@codex review

zoeyrose · 2026-10-12T04:05:18Z

@codex security review

chatgpt-codex-connector · 2026-10-12T04:08:23Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 5bbfa39eac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T04:08:30Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 5bbfa39eac

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

zoeyrose · 2026-10-12T04:59:05Z

@codex review

zoeyrose · 2026-10-12T04:59:08Z

@codex security review

chatgpt-codex-connector · 2026-10-12T05:01:47Z

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: a9179d13b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-12T05:02:28Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: a9179d13b2

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

ci: report dependency advisories without blocking merges

f25f58d

ci: keep dependency advisory reports current and visible

82fe1b0

ci: report dependency advice on pull requests

43857de

ci: refresh advisory reports and current-head guidance

b57a958

chatgpt-codex-connector Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread .github/workflows/dependency-review.yml

ci: fence advisory failure reports to the current revision

5bbfa39

ci: stop advisory reporting when runs are cancelled

a9179d1

zoeyrose merged commit 3ebf16a into main Oct 12, 2026
6 checks passed

zoeyrose deleted the ci/advisory-dependency-review branch October 12, 2026 05:11

Conversation

zoeyrose commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Implementation / behavior

Validation

Limitations / follow-up

Uh oh!

github-actions Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

zoeyrose commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026

🛡️ Codex Security Review

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

zoeyrose commented Oct 12, 2026 •

edited

Loading

github-actions Bot commented Oct 12, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 12, 2026 •

edited

Loading