Skip to content

PER-18047: let a maintainer release past the audit gate #165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
EliMoshkovich merged 3 commits into from
Oct 30, 2026
Merged

PER-18047: let a maintainer release past the audit gate #165

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
320cf43
PER-18047: let a maintainer release past the audit gate
EliMoshkovich Oct 30, 2026
889d1bf
PER-18047: the gate switch names one release's tag, and the summary s…
EliMoshkovich Oct 30, 2026
1329a5b
PER-18047: fix a spelling in the gate comment
EliMoshkovich Oct 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/python-sdk-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,7 +186,21 @@ jobs:
# permit` -- letting a dev-tool advisory block a security release would
# be exactly backwards. The dev tree is still rendered in the summary
# above, and the PR gate does block on it.
#
# A maintainer can release past this gate by setting the repository variable
# RELEASE_SKIP_AUDIT_GATE to that release's exact tag (for example v3.0.1), so a
# value left behind can't affect a later release. Unset, it never equals a tag and
# the gate runs. Delete it after the release. This skips every check --gate makes,
# including the one that refuses an empty or unparsable scanner report. The audit
# above still runs and its report still goes to the job summary.
- name: Note that the gate is skipped
if: vars.RELEASE_SKIP_AUDIT_GATE == github.event.release.tag_name
run: |
echo "::warning title=Audit gate skipped::RELEASE_SKIP_AUDIT_GATE names this release, so it did not gate on the audit. Delete the variable after this release."
echo "> **Audit gate skipped:** RELEASE_SKIP_AUDIT_GATE names this release, so the advisories above did not block it." >> "$GITHUB_STEP_SUMMARY"

- name: Gate on HIGH/CRITICAL (runtime dependencies)
if: vars.RELEASE_SKIP_AUDIT_GATE != github.event.release.tag_name
run: |
set -uo pipefail
python .github/scripts/format_audit.py \
Expand Down
Loading