[x] Is this related to the actions-rs Actions?
If you think it's a problem related to Github Actions in general, use GitHub Community forum instead: https://github.community
[ ] Is this something you can debug and fix? Send a pull request! Bug fixes and documentation fixes are welcome.
Motivation
onefetch currently has many PRs that are failing due to the audit check (discussed in o2sh/onefetch#534). However, these PRs are not introducing dependencies with audit findings. The PRs should probably pass, as the audit findings aren't caused by the PRs themselves, but by the existing dependencies in the main branch that the PRs branched off of.
Workflow example
I would assume that, depending on how this would be implemented, it would require a fetch depth of at least 2 to be able to compare with the previous commit. Although more commits would have to be fetched for multi-commit PRs.
One way to do this might be to fail only if the PR introduces new audit findings that weren't found in the main branch, perhaps by caching the main branch's audit findings somehow.
The other way I can think of would be to compare the diff between the main branch and the PR, and audit only the dependencies that show up in the diff.
Do the checklist before filing an issue:
actions-rs
Actions? If you think it's a problem related to Github Actions in general, use GitHub Community forum instead: https://github.communityMotivation
onefetch currently has many PRs that are failing due to the audit check (discussed in o2sh/onefetch#534). However, these PRs are not introducing dependencies with audit findings. The PRs should probably pass, as the audit findings aren't caused by the PRs themselves, but by the existing dependencies in the main branch that the PRs branched off of.
Workflow example
I would assume that, depending on how this would be implemented, it would require a fetch depth of at least 2 to be able to compare with the previous commit. Although more commits would have to be fetched for multi-commit PRs.
Additional context
One way to do this might be to fail only if the PR introduces new audit findings that weren't found in the main branch, perhaps by caching the main branch's audit findings somehow. The other way I can think of would be to compare the diff between the main branch and the PR, and audit only the dependencies that show up in the diff.