From 336e6809930b527285c12e9e42891c49ec4749df Mon Sep 17 00:00:00 2001 From: kt Date: Tue, 22 Sep 2026 12:56:41 -0700 Subject: [PATCH] ci: rescan the binaries once a release has published Without this the red from a vulnerable release only clears on the next push to main or the Monday cron, not when the fixed release ships. workflow_run on the Release workflow reruns both jobs against main as soon as the assets exist, gated on the release having succeeded. --- .github/workflows/main-binary-scan.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/main-binary-scan.yaml b/.github/workflows/main-binary-scan.yaml index 59f0f7d..ce94cfa 100644 --- a/.github/workflows/main-binary-scan.yaml +++ b/.github/workflows/main-binary-scan.yaml @@ -10,6 +10,12 @@ on: branches: [ 'main' ] schedule: - cron: '23 5 * * 1' # weekly, so new advisories against unchanged binaries still turn main red + # rescan once a release has published, so shipping the fix clears the red rather than the next commit. + # workflow_run is flagged as dangerous because it can hand secrets to a run triggered by untrusted code; + # here it only reacts to the tag-triggered release workflow, checks out main and has read-only permissions + workflow_run: # zizmor: ignore[dangerous-triggers] + workflows: ['Release'] + types: ['completed'] workflow_dispatch: permissions: @@ -19,6 +25,8 @@ jobs: release: name: release binary runs-on: ubuntu-latest + # after a release, only scan if it actually published + if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -46,6 +54,8 @@ jobs: main: name: build of main runs-on: ubuntu-latest + # after a release, only scan if it actually published + if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: