From 71a1af9db42fbd1d61696c3cfd7409d68b988d72 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 16:35:47 +0000 Subject: [PATCH] fix(ci): give the Security Status aggregator its own workflow file The orphan-job self-check (#850) parses .github/workflows/security-policy.yml, but the security-status job had no checkout, so awk and sed found no file and the step exited 2. The verdict step after it was skipped on every run, which left the aggregator red without ever consulting its eight scans. A sparse checkout of just that file, with persist-credentials off, lets the self-check run. actions/checkout@v7.0.1 is already in actions.lock for this workflow, so the lock does not change. Checked locally: the self-check script passes against the edited file (9 jobs, all 8 non-aggregators named in needs:). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01LET2eHeDbN3b4WuxYjMUX9 --- .github/workflows/security-policy.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index 82785297..6157e107 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -755,6 +755,17 @@ jobs: - sbom if: always() steps: + # The self-check below parses this very file, so the file has to be on + # disk. Without this step it reads nothing, exits 2, and the verdict + # step never runs. Only the one file: this job builds nothing. + - name: Checkout this workflow file + uses: actions/checkout@v7.0.1 + with: + sparse-checkout: | + .github/workflows/security-policy.yml + sparse-checkout-cone-mode: false + persist-credentials: false + # #850 AC4: every job in this workflow except the aggregators must be # named in some aggregator's `needs:`. Parse the job keys out of this # very file and compare; a future orphan job fails HERE rather than