From a7e4b9e23e18122fb31fff972c1c5ea3637fec6c Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 11:59:57 +0000 Subject: [PATCH] fix(ci): check out the workflow file in security-status before the self-check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The "Self-check — no orphan jobs" step runs awk/sed over .github/workflows/security-policy.yml, but the Security Status job had no checkout step, so awk exited 2 ("cannot open file") and the aggregator failed on main and every PR regardless of the scan results. Add a sparse checkout of just that file as the first step, using the same actions/checkout@v7.0.1 ref the sibling jobs use, so the per-workflow entry in actions.lock is unchanged. needs:/if: always() are untouched. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01SYkPCGtUuCvgyns6KgzyMX --- .github/workflows/security-policy.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index 82785297..d87df1ca 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -755,6 +755,16 @@ jobs: - sbom if: always() steps: + # The self-check below reads this workflow file, so it must be on disk. + # Without a checkout awk exits 2 ("cannot open file") and the + # aggregator goes red regardless of the scan results. + - name: Checkout workflow file + uses: actions/checkout@v7.0.1 + with: + sparse-checkout: .github/workflows/security-policy.yml + sparse-checkout-cone-mode: false + persist-credentials: false + # #850 AC4: every job in this workflow except the aggregators must be # named in some aggregator's `needs:`. Parse the job keys out of this # very file and compare; a future orphan job fails HERE rather than