Skip to content

ci: drop adoption grace — run the osv lane at hard-fail #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bdelanghe merged 2 commits into from
Jul 30, 2026
Merged

ci: drop adoption grace — run the osv lane at hard-fail #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
118f30f
ci: drop adoption grace — run the osv lane at hard-fail (ci-workflows#8)
Jul 30, 2026
bde9077
deps: crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204)
Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 2 additions & 14 deletions .github/workflows/deps.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,18 +13,8 @@ name: deps
# (OSV has no JSR ecosystem). A repo with nothing scannable passes rather than
# red-lining.
#
# Failure posture is HARD-FAIL by default. This template ships `report-only: true`
# as an ADOPTION GRACE setting: 5 of the first 8 repos scanned carried pre-existing
# advisories, and blocking adoption on remediation would mean most repos stay
# UNINSTRUMENTED while their findings go unseen. Grace decouples "we can see it"
# from "we have fixed it".
#
# >>> DELETE THE `report-only: true` LINE BELOW once this repo's findings are clear.
# >>> That flips it to hard-fail, which is the intended steady state.
# Progress tracked in ci-workflows#2.
#
# Grace downgrades VULNERABILITY findings only. A tool or network failure still fails
# hard in every mode — a lane that cannot run must never report green.
# Failure posture: HARD-FAIL. Adoption grace was removed once this repo's scan
# came back clean (ci-workflows#8) — a known vulnerability now reds the lane.
#
# The reviewable escape hatch for an accepted or unfixable finding is an
# osv-scanner.toml [[IgnoredVulns]] entry next to the lockfile, with a written reason.
Expand Down Expand Up @@ -54,5 +44,3 @@ jobs:
# SHA-pinned per org policy. `# main` records what the SHA was at the time, so a
# reviewer can tell an intentional bump from a drifted one.
uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@62990dd15f1b0deba21e597bebd1512970544c15 # main
with:
report-only: true # adoption grace — delete this once findings are clear (ci-workflows#2)
4 changes: 2 additions & 2 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.