ci(security): run checks on stacked pull requests

[seonghobae]

Summary

• run the repository-local Security workflow for pull requests targeting any base branch
• keep push execution limited to main
• add a regression contract for stacked pull requests

Root cause

GitHub evaluates pull_request.branches against the PR base branch. The main filter therefore left stacked PRs without repository-local CodeQL and Python supply-chain checks.

Verification

• python -m pytest -q tests/test_repository_security_metadata.py (13 passed)
• actionlint .github/workflows/security.yml
• git diff --check

[coderabbitai]

Warning

Review limit reached

Next included review available in 37 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 12fac8cf-ec11-467e-b97a-678780335e3f

📥 Commits

Reviewing files that changed from the base of the PR and between 2e414d1 and 489fedc.

📒 Files selected for processing (2)

• .github/workflows/security.yml
• tests/test_repository_security_metadata.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T13:31:16.742327Z	489fedc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seonghobae]

Superseded by #1066 — verified by content, not by file overlap.

#1066 contains this PR's test function test_security_workflow_supports_stacked_pull_requests byte-identical, and its workflow change is a strict superset:

	#1060	#1066
pull_request trigger	deletes branches: [main]	replaces it with an explicit types: list
draft / closed guard	none	github.event.pull_request.draft == false on all 3 jobs (asserted by count)
concurrency	untouched	cancel-in-progress scoped to PR events; run_id instead of ref for non-PR

Deleting branches: outright (this PR) makes the workflow fire for PRs targeting any branch with no draft or closed guard, so #1066's version is also the safer of the two.

Recommend closing this in favour of #1066 once someone with the authority does so — I am commenting only, not closing another session's PR.

Note for whoever triages: #1072 does not supersede this one. It only changes runs-on: ubuntu-latest → ubuntu-24.04 and touches a different assertion; it carries none of the stacked-PR trigger delta. Treating #1072 as the successor here would drop that delta silently.

Evidence: git diff $(git merge-base origin/main pr1060) pr1060 vs the same for #1066/#1072, on a clone verified 0 commits behind origin/main (a080297).

[seonghobae]

Adjudication evidence (host 1 session, 2026-09-06 KST; full report with commands in #1080). Nothing here closes, flips, or retargets anything — the decision is the opener's.

Same change as #1066's first commit, not verified as superseded. git patch-id of this PR's only commit (489fedc6) equals #1066's 6e7a08fc (fcf1bd00…) and git diff --stat refs/pr/1060 6e7a08fc is empty, but the reverse-apply against #1066's tree fails at security.yml:8 because #1066 replaced the deleted branches: line with types:. This is a fork head, so it cannot accumulate central review evidence (CodeQL job skipped, bootstrap failed, strix cancelled on 489fedc6). Closable only after #1066 is on main and git show origin/main:.github/workflows/security.yml | grep -n branches: shows only the push filter and test_security_workflow_supports_stacked_pull_requests exists there.

[seonghobae]

Closing as fully superseded by merged PR #1066 (merged 2026-09-10), after verifying the previously recorded closure conditions against current protected main 012beaa.

The pull_request trigger has no branches filter, while push remains main-only; test_security_workflow_supports_stacked_pull_requests is retained. The current workflow additionally preserves the successor's explicit event types and draft/closed guards. Both affected files are byte-identical between current main and the isolated validation checkout; all 13 tests in tests/test_repository_security_metadata.py passed. This closes the inherited trigger/test delta, not the separate central fork-trust admission or every stacked PR's hosted acceptance. No source branch is deleted and no fork admission control is bypassed.