required-baseline: skip the two measured no-ops on private-repo PRs - #364
Merged
Conversation
Both jobs are measured no-ops on the org's private repos — OSV finds no supported lockfile in .github-private, dependency-review needs GHAS — yet each fire bills its startup minute against the private quota (August 2026: 50 runs × 2 jobs = 100 billable min; run 33701664258 inspected, both green with nothing evaluated; ≈250/month forward). The `if:` is scoped to the two jobs, not the workflow, so a future repository_dispatch step (.github-private#779) is not skipped with them. The header records the measurement and that "no private repo can satisfy GHAS" is a plan question (schema.ts says Team, merge-gate.md says Free) — revisit the skip if GHAS is enabled. Claim-issue: #362 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016vMtEPPAZ9y24u9Z4CQA8d
…ine-private-skip-1hyins
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
osvanddependency-reviewinrequired-baseline.ymlgetif: github.event.repository.private != true. Job-scoped, so a futurerepository_dispatchstep (.github-private#779) is not caught by the same condition.!= truerather than== falseso an absent field fails toward scanning.This workflow is
on: pull_requestinjected by the org ruleset, not aworkflow_callreusable — so the calling repo isgithub.event.repositoryfrom the PR payload directly; nothing to plumb.Why
Both jobs are no-ops on private repos and still bill a startup minute each against the private quota. Measured (
actions-spend-census.sh,.github-private#868):.github-private, August 2026, 50 runs × 2 jobs = 100 billable min; run 33701664258 inspected, both jobs green with nothing evaluated. Inferred: ≈250/month forward at September's PR rate.Whether "no private repo can satisfy GHAS" holds is a plan question (
.github-privateregistry/schema.ts:13says Team,docs/merge-gate.md:779says Free; Code Security is purchasable on Team). The header says to revisit the skip if GHAS is enabled.Verified
node --test .claude/*.test.mjs— 300 passnode --test *.test.mjs— 279 passifCloses_workflow-lintis the checkDone-when still open
The third item on #362 — a private-repo PR observed reporting
skippedrather thansuccess— is a post-merge observation.Part of
.github-private#798's plan (deliverable 5 in its 2026-09-03 comment). Claimed here because a public repo'spr-claimcannot read a private claim.Claim-issue: #362
🤖 Generated with Claude Code
https://claude.ai/code/session_016vMtEPPAZ9y24u9Z4CQA8d
Generated by Claude Code