Skip to content

fix(semgrep): run the package-manager scan on Depot everywhere #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
posthog wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

fix(semgrep): run the package-manager scan on Depot everywhere #71

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions .github/workflows/semgrep-package-managers.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,10 @@ env:
jobs:
# scans the entire repo for package managers missing a minimum release age / cooldown
semgrep-package-managers:
# This workflow runs org-wide as a required workflow. Private/internal repos
# get the faster Depot runner; public repos stay on GitHub-hosted ubuntu-latest
# (free minutes, and not every public repo has Depot enabled). The repository
# context reflects the target repo, so this resolves per-repo automatically.
runs-on: ${{ github.event.repository.private && 'depot-ubuntu-latest' || 'ubuntu-latest' }}
# This workflow runs org-wide as a required workflow. It uses the Depot runner
# everywhere. The shared GitHub-hosted ubuntu-latest pool queues this required
# check for longer than it runs, so public repos no longer stay on that pool.
runs-on: depot-ubuntu-latest

@posthog posthog Bot Aug 24, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Depot is not enabled for every public repository

must_fix bug

Why we think it's a valid issue
  • Checked: the PR diff, the full workflow file, the sibling workflow semgrep.yml, a repo-wide grep for depot, CLAUDE.md, and the git history of both semgrep workflows.
  • Found: .github/workflows/semgrep.yml:20 still carries the identical ${{ github.event.repository.private && 'depot-ubuntu-latest' || 'ubuntu-latest' }} expression, and the PR does not touch it. The conditional is therefore a deliberate, repeated pattern in this repo, not a one-off leftover. Its sibling comment at semgrep.yml:16 repeats the same reason.
  • Found: the deleted comment at .github/workflows/semgrep-package-managers.yml:16-19 records the constraint as a statement of fact, not as a guess. The PR removes the guard and the reason together. The PR body weighs only the cost trade-off (paid Depot minutes against free GitHub minutes). It gives no evidence that Depot access now covers every public repo.
  • Found: the workflow declares on: pull_request and merge_group with no workflow_call trigger, so it runs org-wide as a required workflow against each target repo. Commit 9c9ec54 confirms this failure mode is real: it describes an unrelated exit code that "reds this required check in whichever repo it ran against".
  • Found: timeout-minutes: 15 at line 21 does not limit this risk. That budget counts run time after a runner picks the job up. It does not count queue time. A job whose runs-on label matches no available runner stays queued until GitHub cancels it, roughly 24 hours later.
  • Impact: in any repo that the Depot runner group does not cover, this required check never starts. The pull request stays blocked for up to a day, then the check ends in a non-success state and keeps blocking. Because this file is an org-wide required workflow, the blast radius is every affected repo at once, and recovery needs a second change to this repo. The premise is confirmed by the repo itself rather than speculative, so it clears the bar.
  • Impact: the fix is cheap to verify before merge. Confirm Depot runner-group access for every target repo, or keep the fallback expression.
Issue description

The removed comment states that some public repositories cannot use Depot. Those repositories will not find a runner with this label. Their required check can remain queued and block merges.

Suggested fix

Grant the Depot runner group access to every target repository before this change merges. If that is not possible, keep the existing fallback for repositories without Depot access.

Prompt to fix with AI (copy-paste) 
## Context
@.github/workflows/semgrep-package-managers.yml#L19

<issue_description>
The removed comment states that some public repositories cannot use Depot. Those repositories will not find a runner with this label. Their required check can remain queued and block merges.
</issue_description>

<issue_validation>
- **Checked:** the PR diff, the full workflow file, the sibling workflow `semgrep.yml`, a repo-wide grep for `depot`, `CLAUDE.md`, and the git history of both semgrep workflows.
- **Found:** `.github/workflows/semgrep.yml:20` still carries the identical `${{ github.event.repository.private && 'depot-ubuntu-latest' || 'ubuntu-latest' }}` expression, and the PR does not touch it. The conditional is therefore a deliberate, repeated pattern in this repo, not a one-off leftover. Its sibling comment at `semgrep.yml:16` repeats the same reason.
- **Found:** the deleted comment at `.github/workflows/semgrep-package-managers.yml:16-19` records the constraint as a statement of fact, not as a guess. The PR removes the guard and the reason together. The PR body weighs only the cost trade-off (paid Depot minutes against free GitHub minutes). It gives no evidence that Depot access now covers every public repo.
- **Found:** the workflow declares `on: pull_request` and `merge_group` with no `workflow_call` trigger, so it runs org-wide as a required workflow against each target repo. Commit 9c9ec54 confirms this failure mode is real: it describes an unrelated exit code that "reds this required check in whichever repo it ran against".
- **Found:** `timeout-minutes: 15` at line 21 does not limit this risk. That budget counts run time after a runner picks the job up. It does not count queue time. A job whose `runs-on` label matches no available runner stays queued until GitHub cancels it, roughly 24 hours later.
- **Impact:** in any repo that the Depot runner group does not cover, this required check never starts. The pull request stays blocked for up to a day, then the check ends in a non-success state and keeps blocking. Because this file is an org-wide required workflow, the blast radius is every affected repo at once, and recovery needs a second change to this repo. The premise is confirmed by the repo itself rather than speculative, so it clears the bar.
- **Impact:** the fix is cheap to verify before merge. Confirm Depot runner-group access for every target repo, or keep the fallback expression.
</issue_validation>

## Task
Investigate the issue and solve it

<potential_solution>
Grant the Depot runner group access to every target repository before this change merges. If that is not possible, keep the existing fallback for repositories without Depot access.
</potential_solution>

@posthog posthog Bot Aug 24, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a real risk worth resolving before merge, but it needs a human decision rather than an automated fix.

The change pins the job to depot-ubuntu-latest unconditionally. Because this workflow runs org-wide as a required check (it triggers on pull_request and merge_group with no workflow_call), any target repo whose runner set does not include a Depot runner will never find a match for that label. timeout-minutes: 15 does not help — it only counts run time once a runner picks up the job, not queue time, so such a job stays queued until GitHub cancels it (~24h) and blocks merges the whole time. The blast radius is every affected repo at once.

The premise looks solid: the sibling workflow .github/workflows/semgrep.yml still uses the same ${{ github.event.repository.private && 'depot-ubuntu-latest' || 'ubuntu-latest' }} fallback, and its comment there states outright that not every public repo has Depot enabled. This PR removed that guard and its explaining comment without evidence that Depot coverage now spans every public repo.

What a human needs to decide: confirm the Depot runner group grants access to every target/public repo in the org — if so, the hardcoded label is safe (and semgrep.yml should arguably be updated the same way for consistency); if not, keep the fallback expression here as semgrep.yml still does. I can't verify Depot org coverage from the code, and this is a CI/workflow file, so I'm not making the change unattended.

timeout-minutes: 15
container:
image: semgrep/semgrep:1.163.0@sha256:7cad2bc2d1e44f87f0bf4be6d1fa23aa90fb72015bebc89fb91385d813987a03
Expand Down