[BartLucien]

Part of CLP-906

---

Summary by Gitar

• Split workflow:
  • Renamed the build job to build and moved IRIS analysis into a new run_iris job
  • Gated run_iris on a successful build result via if and needs
• Concurrency:
  • Added workflow-level concurrency group that cancels in-progress runs per ref
  • Serialized IRIS runs with a single-slot iris concurrency group
• Permissions:
  • Raised build job contents permission to write to fix CI
  • Limited run_iris job to contents: read with id-token: write

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

CLP-1193

✅ All code review findings resolved.

_{Configure merge blocking}

[GabrielFleischer]

LGTM

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🔴 High risk · Granting the build job contents: write in .github/workflows/unified-dogfooding.yml could let compromised build steps modify repository contents.

Splits the unified dogfooding workflow into a build job and a separate run_iris job gated on build success, with concurrency groups and scoped permissions. The run_iris needs reference to the renamed job is fixed, and no open issues remain.

✅ 1 closed

✅ Bug: run_iris needs points to renamed job unified-platform-dogfooding

📄 .github/workflows/unified-dogfooding.yml:12 📄 .github/workflows/unified-dogfooding.yml:35-36
This PR renames the job unified-platform-dogfooding to build, but run_iris still has needs: [unified-platform-dogfooding]. GitHub rejects workflows whose needs names a job that doesn't exist, so the whole workflow fails validation. Neither the scheduled run nor a manual dispatch will run. Even if that were fixed some other way, the if: condition reads needs.build.result, and that only works when build is listed in needs. Change it to needs: [build].

Verification

Functional validation No results

Rules No rules evaluated

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube