From 3bfbd7059fce01c54914c4cfd71b09eb4e714f80 Mon Sep 17 00:00:00 2001 From: ralyodio Date: Fri, 17 Jul 2026 01:56:01 +0000 Subject: [PATCH] ci(vu1nz-scan): don't fail the scan when the PR comment can't be posted Dependabot PRs run with a read-only GITHUB_TOKEN, and GitHub was returning 503 (the HTML "Unicorn" page) for the comment write; the step's catch only handled 403 and re-threw everything else, failing the whole scan even though the security scan itself passed. - skip the comment step for github.actor == 'dependabot[bot]' - continue-on-error: true - warn-and-continue on any status instead of only 403 Mirrors sh1pt pack vu1nz-scan@1.0.1. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/vu1nz-scan.yml | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/workflows/vu1nz-scan.yml b/.github/workflows/vu1nz-scan.yml index f6b8df4..8f33868 100644 --- a/.github/workflows/vu1nz-scan.yml +++ b/.github/workflows/vu1nz-scan.yml @@ -166,7 +166,12 @@ jobs: fi - name: Comment on PR - if: always() && github.event.pull_request.head.repo.full_name == github.repository + # Best-effort only. Skip for Dependabot (read-only token can't comment) + # and never fail the job if posting the comment errors — the scan's + # pass/fail is decided by the "Build PR comment" step, and findings are + # always written to the job summary. + if: always() && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]' + continue-on-error: true uses: actions/github-script@v9 with: script: | @@ -206,9 +211,9 @@ jobs: }); } } catch (err) { - if (err.status === 403) { - core.warning(`Cannot post PR comment (read-only token): ${err.message}. Findings are in the job summary.`); - } else { - throw err; - } + // Posting the comment is best-effort. Read-only tokens return 403 + // and transient GitHub outages return 503 (the "Unicorn" HTML + // page); neither should fail the scan. Findings are in the job + // summary regardless. + core.warning(`Could not post PR comment (status ${err.status ?? 'unknown'}): ${err.message}. Findings are in the job summary.`); }