jpmschweitzer/clide
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ci: run osv-scanner in CI, not push-check (T-353)

Browse Source 
Keep the security gate out of the local pre-push path so dev machines
don't need osv-scanner installed. The `make security` target and
ci/osv_scan.sh stay for the CI PR-merge pipeline (and on-demand local
runs); only the push-check prerequisite is removed, with a NOTE in the
Makefile explaining where it runs instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
jpmschweitzer
2026-06-11 09:08:30 +02:00
co-authored by Claude Opus 4.8
parent 34ce01cbf1
commit bcea5f15b7
2 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+6 -2
View File
@@ -309,7 +309,7 @@ clide-cli-clean: ## Remove the compiled C `clide` client.
# -- security -------------------------------------------------------------
.PHONY: security
security: ## Supply-chain gate — osv-scanner over pubspec.lock (fails on a known advisory).
security: ## Supply-chain gate — osv-scanner over pubspec.lock (CI PR-merge pipeline; run locally on demand). Fails on a known advisory.
ci/osv_scan.sh
# -- pre-push gate --------------------------------------------------------
@@ -319,7 +319,11 @@ decisions-validate: ## Parser dry-run over governance/{decisions,questions,rejec
pql decisions validate
.PHONY: push-check
push-check: decisions-validate changelog-gate security test-coverage coverage-gate test-core ## Pre-push gate (fast — <2 min target). Order is fail-fast: instant gates (decisions, changelog, security/osv) first, then the coverage suite + gate (the expensive, most-likely-to-fail stage) BEFORE test-core — a coverage miss aborts here instead of after running everything, so a fix doesn't force a full re-run of the rest. test-coverage already runs the a11y suite (test/a11y), so no separate test-a11y pass.
# NOTE: the `security` (osv-scanner) gate is deliberately NOT in push-check —
# it runs in the CI PR-merge pipeline (where the scanner is provisioned) so we
# don't force every dev machine to install osv-scanner. Run it locally any time
# with `make security`.
push-check: decisions-validate changelog-gate test-coverage coverage-gate test-core ## Pre-push gate (fast — <2 min target). Order is fail-fast: instant gates (decisions, changelog) first, then the coverage suite + gate (the expensive, most-likely-to-fail stage) BEFORE test-core — a coverage miss aborts here instead of after running everything, so a fix doesn't force a full re-run of the rest. test-coverage already runs the a11y suite (test/a11y), so no separate test-a11y pass.
.PHONY: push-check-full
push-check-full: push-check test-integration smoke-bundle ## Pre-release gate (push-check + integration + smoke; slower).