From 663dc6670f887b29fdb90663854ae5cb27a6a154 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 11:06:50 +0000 Subject: [PATCH] ci(deps): tighten OSV/dependency scan schedule from weekly to daily MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scheduled scan (validate-deps.yml) is the discovery trigger for a new OSV advisory; the per-PR path trigger is the blocking trigger. Between weekly Monday runs, a new advisory could go undetected for up to six days, so the first PR touching a manifest ate a red unrelated to its diff — six occurrences in a month (#14645). Moves the cron from '0 3 * * 1' (weekly, Monday 03:00 UTC) to '0 3 * * *' (daily, same hour) — Option A from the card, ruled by the maintainer (issue comment #5523306978): tighten cadence now, defer the automatic issue-opening outlet (Option B) pending measurement of whether a daily red still goes unseen. The ruling names .github/workflows/osv-scanner.yml, which does not exist; applying its substance to validate-deps.yml, the file the card's own body correctly names and which actually carries this schedule trigger. Fixes #14645 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk --- .github/workflows/validate-deps.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/validate-deps.yml b/.github/workflows/validate-deps.yml index 55116f1d4b..ded2085fd5 100644 --- a/.github/workflows/validate-deps.yml +++ b/.github/workflows/validate-deps.yml @@ -18,8 +18,11 @@ on: # exercised on the PR that introduces them. - '.github/workflows/validate-deps.yml' schedule: - # Run weekly on Monday at 03:00 UTC - - cron: '0 3 * * 1' + # Run daily at 03:00 UTC — narrows the discovery window for a new OSV + # advisory from up to six days (weekly) to one, so the scheduled scan + # is more likely to surface a red before an unrelated PR's blocking + # trigger collides with it (#14645). + - cron: '0 3 * * *' workflow_dispatch: jobs: