Repository navigation
ci: dependency-review required check fails closed because Dependency Graph is disabled on TEPP #498
Description
Finding
The organization required workflow dependency-review fails closed on ContextualWisdomLab/TEPP whenever it runs, independent of the pull request content.
Exact-head evidence: PR #497 head 8db3a57b, run 34754213609 (attempts 1 and 2, the second after rerun-failed-jobs):
##[error]Dependency review evidence unavailable for ContextualWisdomLab/TEPP at exact base a243f18d... and head 8db3a57b...: HTTP 403; curl exit 0. Verify dependency-graph/security configuration and GitHub service behavior, then rerun.
Reproduction with a repository-admin user token (not a rate limit; core quota was 5000/5000 at the time):
gh api repos/ContextualWisdomLab/TEPP/dependency-graph/compare/a243f18d...8db3a57b # HTTP 403 Forbidden
gh api repos/ContextualWisdomLab/TEPP/dependency-graph/sbom # HTTP 404 Not Found
The SBOM endpoint returning 404 on a public repository means the Dependency Graph feature is disabled for this repository, so the dependency-review compare API cannot answer. On PRs where the check is skipping (#480, #492) the workflow simply did not select the job; it is not passing there.
Impact
Any PR on which the required dependency-review check is selected cannot reach a clean required-check state. This is a repository configuration defect, not a code or supply-chain finding of the affected PR.
Required action (repository/org admin; not performable by automation)
- Enable Dependency Graph for ContextualWisdomLab/TEPP (Settings → Code security → Dependency graph), then confirm
gh api repos/ContextualWisdomLab/TEPP/dependency-graph/sbomreturns 200. - Rerun the failed
dependency-reviewjob on the affected head and confirm the compare call succeeds. - If the
.githubreusable workflow is meant to skip rather than fail on repositories without Dependency Graph, that is a separate.github-owner decision; TEPP should keep fail-closed until then.
Tracking
- Owner: ContextualWisdomLab/TEPP repository admin (setting);
.githubfor the reusable workflow behaviour. - Internal action deadline: 2026-09-20 (blocks required checks on every affected PR).
- Next review: 2026-09-16.
- Related: test(quality): exercise Python CLI entrypoints instead of pragma suppression #497 (first observed), org required workflow
dependency-review.yml.
Activity
seonghobae commentedon Sep 14, 2026
Quantifying the impact, measured 2026-09-15 across all 100 open pull requests.
dependency-reviewis currently a failing check on 29 of the 80 failing PRs, making it the sixth most common blocker in the queue. It fails for the same reason on all of them: the Dependency Graph is disabled for this repository, so the action has nothing to read.This one is not fixable from a branch. It needs a repository administrator to enable Settings → Code security → Dependency graph. The verification afterwards is
gh api repos/ContextualWisdomLab/TEPP/dependency-graph/sbom --jq .sbom.namereturning 200 instead of 403.Recording the count so this can be prioritised against the other queue blockers rather than treated as background noise.
seonghobae commentedon Sep 16, 2026
2026-09-17 fresh owner-path check: the repository-side Dependency Graph prerequisite is still unresolved. PR #538 remains on exact
0a6947b11f2dba9e161f2abe8bdec0f652d4b47a; its Dependency Review path remains fail-closed, and this issue is still the canonical TEPP repository-setting blocker. No leaf workflow shim or substitute scanner has been introduced.Separate CodeQL state has progressed and should not be conflated with this setting blocker: attempt-2 compatibility jobs
104915624181(python) and104915624335(actions) both obtained hosted runners and terminally failed while reading an absent current-head dispatch verdict. The subsequentDispatch current-head CodeQL scanjob104992789328is the item that remains queued pre-checkout (steps=[]).Next valid action here remains repository-admin enablement of Dependency Graph, confirmation that the SBOM endpoint returns HTTP 200, and then an unchanged-head Dependency Review rerun.
seonghobae commentedon Sep 17, 2026
2026-09-17 fresh follow-up on #538 exact
0a6947b11f2dba9e161f2abe8bdec0f652d4b47a: Dependency Review remains the same repository-setting blocker. Security run35045658427still hasdependency-reviewjob104707865105terminal failure atCheck dependency review support; OSV and Scorecard are successful but are not substitutes for the required dependency-review evidence.CodeQL is a separate lane and has advanced to attempt 3.
Detect CodeQL languagesjob105046923125is terminal success; python compatibility job105046943410obtained a hosted runner and terminally failed atRead current-head CodeQL dispatch verdict; actions compatibility job105046922540is currently queued pre-checkout withrunner_id=0andsteps=[]. Do not treat the CodeQL queue state as evidence that the Dependency Graph prerequisite changed.Next valid Dependency Review action remains repository-admin enablement of Dependency Graph, SBOM endpoint HTTP 200 verification, then unchanged-head rerun.
seonghobae commentedon Sep 17, 2026
Fresh exact-head reproduction on the current main-target successor: PR #538 exact
0a6947b11f2dba9e161f2abe8bdec0f652d4b47a, Security Scan run35045658427, jobdependency-review104707865105. The job received a GitHub-hosted runner and checkout succeeded, thenCheck dependency review supportfailed; the actualDependency reviewaction was skipped. In the same run,osv-scanandscorecardcompleted SUCCESS, so those remain complementary scanners rather than substitutes for the required dependency-review evidence.No rerun was issued because the repository prerequisite tracked here has not been shown to change. Required next action remains repository-admin enablement of Dependency Graph, SBOM endpoint HTTP 200 verification, then an unchanged-head rerun. Until that prerequisite changes, repeated leaf reruns would be blind and should remain avoided.
seonghobae commentedon Sep 17, 2026
Fresh unchanged-head evidence from foundation #538 exact
0a6947b11f2dba9e161f2abe8bdec0f652d4b47a: Security Scan run35045658427is still failure solely on requireddependency-reviewjob104707865105. That job obtained a hosted runner and exact-head checkout successfully, then failed atCheck dependency review support; the actualDependency reviewstep was skipped. OSV job104707865051and Scorecard job104707865097succeeded, but they are not substitutes for the required dependency-review evidence. #498 therefore remains the correct repository-admin owner path: enable Dependency Graph, verify SBOM HTTP 200, then rerun unchanged-head dependency-review.seonghobae commentedon Sep 17, 2026
Fresh downstream confirmation for Ready PR #538 exact
0a6947b11f2dba9e161f2abe8bdec0f652d4b47a: Rust Foundation, Documentation Quality, and Semgrep are GREEN; Security Scan run35045658427remains FAILURE and the repository-admin Dependency Graph prerequisite is still open. #538 is otherwise unchanged and mergeable. Keep the owner action as written: enable Dependency Graph, verify the repository SBOM endpoint returns HTTP 200, then rerun dependency-review on the unchanged head. No scanner substitution or leaf gate weakening is authorized.seonghobae commentedon Sep 19, 2026
2026-09-19 fresh exact-head canary: PR #538 exact
f335624cea977fea7d7fe6f36871868557fe2bb7, Security Scan run35389817143is terminal FAILURE specifically at dependency-review support admission. Job105811205491acquired a GitHub-hostedubuntu-24.04runner, completed exact checkout/verification, then the support probe called the exact dependency-graph compare endpoint for basea243f18da4a4ca8a8d068c39922537f1f8ed6ad0and this head and recordedhttp_status=403 curl_exit=0. The pinnedactions/dependency-review-action@a1d282b...step therefore did not run. Same run's changed-scope, Scorecard, and OSV jobs executed successfully.This materially narrows the current blocker: for this exact generation it is not generic runner acquisition starvation, and the historical HTTP 403 in this issue reproduces on the current Ready foundation head. The 403 still does not by itself prove which repository/account configuration property is causal.
Canonical cross-repository owner
.github#810has been updated with this specimen. Keep #498 open until an authorized repository/org configuration read/write path establishes the actual dependency-graph state, repairs it if needed, and a fresh unchanged-head canary reaches HTTP 200 plus execution of the pinned dependency-review action. No leaf wake commit or substitute scanner is justified.seonghobae commentedon Sep 22, 2026
Fresh 2026-09-22 verification confirms this remains a live external repository-configuration blocker, not a PR-local dependency finding.
Main-target successor #538 exact
f335624cea977fea7d7fe6f36871868557fe2bb7already contains the canonicalrustls = 0.23.45repair from #526. Its Rust Foundation run35389817094is GREEN and its OSV/Trivy/Scorecard security jobs are GREEN, but Security run35389817143fails only independency-reviewatCheck dependency review support; the dependency-review action itself is skipped after that fail-closed support probe. This is the same Dependency Graph availability defect tracked here.The earlier internal deadline (2026-09-20) has passed. Required admin action is unchanged: enable Dependency Graph for TEPP and verify the SBOM/compare API is available, then rerun the exact affected required check. Do not weaken or skip the required workflow in TEPP to make #538 mergeable.
This also blocks #648 indirectly: its exact-head cargo-deny failure is RUSTSEC-2026-0285 on protected main's rustls 0.23.43, while the canonical fixed dependency state is already carried by #538. #648 therefore remains Draft and must ordinary-forward reconcile after #538 (or a verified complete successor) reaches protected main.