fix: revert security-scan.yml to inline, not a reusable-workflow call #8

Merged

james merged 1 commit from fix/inline-security-scan into main

2026-09-07 20:10:17 +00:00

james commented

2026-09-07 20:04:18 +00:00

Owner

Same fix as colibrisec/balam#20 -- calling forgejo-workflows' shared security-scan reusable workflow silently stopped ojo-forgejo's PR comments from posting. Reverting to the known-working inline form.

james added 1 commit

2026-09-07 20:04:19 +00:00

fix: revert security-scan.yml to inline, not a reusable-workflow call

test / test (pull_request) Successful in 8s

Details

security-scan / security-scan (pull_request) Successful in 1m1s

Details

4496e99912

Calling forgejo-workflows' shared security-scan reusable workflow
silently broke ojo-forgejo's PR comments: they posted on every PR
through #12, and on zero PRs since #13 -- the exact commit that
converted this to uses:. No visibility into forgejo-runner internals to
know why a nested custom action loses the PR context when invoked
through a reusable workflow, but the correlation is total across 7+
PRs. Reverting to the known-working inline form; renovate.yml is
unaffected (it never posts PR comments) and stays on the shared
workflow.