From a3f2ac04fb3f37e49968bea565d712211cdd4e20 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Tue, 20 Oct 2026 19:31:54 +0200 Subject: [PATCH] ci: document that the Snyk scan is non-gating and drop unused GO_VERSION Snyk is an external service, so it stays continue-on-error and out of ci-success.needs, now stated in the workflow, as in cloud-commitments-cli. The workflow-level GO_VERSION env was never read (setup-go uses go.mod). Part of #2 (item 8). Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c03a06d..91ead4e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,10 +3,10 @@ # This workflow runs on every pull request and push to main/develop branches. # It performs comprehensive quality checks before allowing code to be merged. # -# Required GitHub Secrets: None (all checks run without cloud credentials) +# Required GitHub Secrets: None (all checks run without cloud credentials). +# Optional: SNYK_TOKEN enables the non-gating Snyk scan. # -# Required GitHub Variables: -# - GO_VERSION: Go version to use (default: 1.26.9) +# Required GitHub Variables: None # # Triggered by: # - Pull requests to main/develop @@ -25,9 +25,6 @@ on: branches: [main, develop] workflow_dispatch: -env: - GO_VERSION: '1.26.9' - jobs: lint: name: Lint Code @@ -565,6 +562,9 @@ jobs: with: go-version-file: go.mod + # Non-gating on purpose: Snyk is an external service, so its outages or + # rate limits must not block merges. It is deliberately absent from + # ci-success.needs. - name: Run Snyk to check for vulnerabilities uses: snyk/actions/golang@9adf32b1121593767fc3c057af55b55db032dc04 # 1.0.0 continue-on-error: true