From 320cf438c1aa041d35b9fdbe0b9b0c7400bed742 Mon Sep 17 00:00:00 2001 From: eli Date: Fri, 30 Oct 2026 14:44:38 -0500 Subject: [PATCH 1/3] PER-18047: let a maintainer release past the audit gate Co-Authored-By: Claude Opus 5.5 --- .github/workflows/python-sdk-publish.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/python-sdk-publish.yml b/.github/workflows/python-sdk-publish.yml index f185707d..0e5be91f 100644 --- a/.github/workflows/python-sdk-publish.yml +++ b/.github/workflows/python-sdk-publish.yml @@ -186,7 +186,16 @@ jobs: # permit` -- letting a dev-tool advisory block a security release would # be exactly backwards. The dev tree is still rendered in the summary # above, and the PR gate does block on it. + # + # A maintainer can release past this gate by setting the repository variable + # RELEASE_SKIP_AUDIT_GATE to "true", and deleting it after that release. The + # audit above still runs and its report still goes to the job summary. + - name: Note that the gate is skipped + if: vars.RELEASE_SKIP_AUDIT_GATE == 'true' + run: echo "::warning title=Audit gate skipped::RELEASE_SKIP_AUDIT_GATE is set, so this release did not gate on the audit. Delete the variable after this release." + - name: Gate on HIGH/CRITICAL (runtime dependencies) + if: vars.RELEASE_SKIP_AUDIT_GATE != 'true' run: | set -uo pipefail python .github/scripts/format_audit.py \ From 889d1bfac4314dff3a2decfe772d0ac728e0173b Mon Sep 17 00:00:00 2001 From: eli Date: Fri, 30 Oct 2026 15:14:17 -0500 Subject: [PATCH 2/3] PER-18047: the gate switch names one release's tag, and the summary says so Co-Authored-By: Claude Opus 5.5 --- .github/workflows/python-sdk-publish.yml | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/.github/workflows/python-sdk-publish.yml b/.github/workflows/python-sdk-publish.yml index 0e5be91f..a5179bc9 100644 --- a/.github/workflows/python-sdk-publish.yml +++ b/.github/workflows/python-sdk-publish.yml @@ -188,14 +188,19 @@ jobs: # above, and the PR gate does block on it. # # A maintainer can release past this gate by setting the repository variable - # RELEASE_SKIP_AUDIT_GATE to "true", and deleting it after that release. The - # audit above still runs and its report still goes to the job summary. + # RELEASE_SKIP_AUDIT_GATE to that release's exact tag (for example v3.0.1), so a + # value left behind can't affect a later release. Unset, it never equals a tag and + # the gate runs. Delete it after the release. This skips every check --gate makes, + # including the one that refuses an empty or unparseable scanner report. The audit + # above still runs and its report still goes to the job summary. - name: Note that the gate is skipped - if: vars.RELEASE_SKIP_AUDIT_GATE == 'true' - run: echo "::warning title=Audit gate skipped::RELEASE_SKIP_AUDIT_GATE is set, so this release did not gate on the audit. Delete the variable after this release." + if: vars.RELEASE_SKIP_AUDIT_GATE == github.event.release.tag_name + run: | + echo "::warning title=Audit gate skipped::RELEASE_SKIP_AUDIT_GATE names this release, so it did not gate on the audit. Delete the variable after this release." + echo "> **Audit gate skipped:** RELEASE_SKIP_AUDIT_GATE names this release, so the advisories above did not block it." >> "$GITHUB_STEP_SUMMARY" - name: Gate on HIGH/CRITICAL (runtime dependencies) - if: vars.RELEASE_SKIP_AUDIT_GATE != 'true' + if: vars.RELEASE_SKIP_AUDIT_GATE != github.event.release.tag_name run: | set -uo pipefail python .github/scripts/format_audit.py \ From 1329a5be3a512defee61185afc402c1a2c7ef2e3 Mon Sep 17 00:00:00 2001 From: eli Date: Fri, 30 Oct 2026 15:19:56 -0500 Subject: [PATCH 3/3] PER-18047: fix a spelling in the gate comment Co-Authored-By: Claude Opus 5.5 --- .github/workflows/python-sdk-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/python-sdk-publish.yml b/.github/workflows/python-sdk-publish.yml index a5179bc9..efbbb95f 100644 --- a/.github/workflows/python-sdk-publish.yml +++ b/.github/workflows/python-sdk-publish.yml @@ -191,7 +191,7 @@ jobs: # RELEASE_SKIP_AUDIT_GATE to that release's exact tag (for example v3.0.1), so a # value left behind can't affect a later release. Unset, it never equals a tag and # the gate runs. Delete it after the release. This skips every check --gate makes, - # including the one that refuses an empty or unparseable scanner report. The audit + # including the one that refuses an empty or unparsable scanner report. The audit # above still runs and its report still goes to the job summary. - name: Note that the gate is skipped if: vars.RELEASE_SKIP_AUDIT_GATE == github.event.release.tag_name