[Copilot]

Canonical issue

Linked through issue automation.

Outcome

Security-marked PRs now require complete security dependency evidence when GitHub may have truncated the changed-file list, preventing hidden dependency changes from bypassing validation.

Scope

• Included: Treat capped listings and missing or invalid file-count metadata as incomplete.
• Explicitly excluded: Dependency review behavior and production runtime.

const fileListIncomplete =
  !Number.isInteger(pr.changed_files) ||
  changedFiles.length < pr.changed_files ||
  changedFiles.length >= 3000;

Risk

• Risk level: low
• Failure mode: A security-marked PR with an incomplete listing must provide evidence or validation fails.
• Rollback: Revert the workflow and regression-test changes.

Verification

• Focused tests
• Required CI
• Review threads resolved

Production evidence

Not applicable; this changes PR validation only.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

Security dependency evidence

• Advisory: N/A — workflow guard change, not advisory remediation
• Package and versions: N/A
• Validation: Incomplete file evidence triggers the existing evidence requirement
• Rollback: Revert the workflow and regression-test changes

• Fixes Fail security PR checks closed when file evidence is truncated #2415

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Nov 3, 2026 8:25am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: groupthinking/EventRelay
• Branch: main
• File: .coderabbit.yaml
• Commit: b05aae6
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3d4bc2d0-5533-4986-b7c4-54baea92779e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[github-actions]

🔍 PR Validation

⚠️ PR title should follow conventional commits format

[Copilot]

🟢 Approved

No active review issues are reported for the stricter security dependency evidence checks.

No open issues 🎉

What changed in this PR

This PR addresses #2415 by strengthening security dependency evidence checks when GitHub’s changed-file listing may be incomplete. It affects PR validation only, leaving dependency review and production runtime unchanged.

Changes:

• Treat missing or non-integer file counts, undersized listings, and listings reaching GitHub’s 3,000-file cap as incomplete.
• Add regression tests for capped listings and missing file-count metadata.

File	Description
tests/​unit/​test_security_dependency_pr_evidence.py	Extends the test harness and covers capped listings and missing metadata.
.github/​workflows/​pr-checks.yml	Requires security dependency evidence when file-list completeness cannot be established.

_{Review effort: Balanced}