Skip to content

chore(ci): main push 도 신뢰된 의존성 스냅샷을 제출한다 (closes 1063) [base: develop] #1182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
OnlyReadOneBook merged 1 commit into from
Aug 26, 2026
Merged

chore(ci): main push 도 신뢰된 의존성 스냅샷을 제출한다 (closes 1063) [base: develop] #1182

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions .github/workflows/dependency-submission.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,15 @@
name: Gradle Dependency Submission

# develop push 는 신뢰된 base snapshot 을 직접 제출한다. PR 은 fork 를 포함해 write token 없이
# develop·main push 는 신뢰된 base snapshot 을 직접 제출한다. PR 은 fork 를 포함해 write token 없이
# snapshot artifact 만 만들고, default branch 의 별도 workflow_run 이 이를 제출한다.
#
# main 이 함께 있어야 하는 이유 — dependency-review 는 PR 의 base ref 스냅샷과 head 스냅샷을
# 짝지어 «추가된 의존성» 을 계산한다. develop 만 제출하면 릴리스 PR(develop → main)의 base 가
# 빈 것으로 보여 의존성 903 건 전량이 신규 도입으로 잡히고, 그 안에 섞인 기존 취약점이 릴리스
# PR 탓으로 걸린다 (#1063 실측: added 903 = develop 스냅샷 고유 패키지 수).
on:
push:
branches: [develop]
branches: [develop, main]
pull_request:

concurrency:
Expand All @@ -15,9 +20,9 @@ permissions:
contents: read

jobs:
submit-default-branch:
submit-trusted-branch:
if: github.event_name == 'push'
name: Submit trusted develop dependency graph
name: Submit trusted branch dependency graph
runs-on: ubuntu-latest
permissions:
contents: write
Expand Down
Loading