From 353955372201f3ce0f0c4b826c1cfb31a2926e7d Mon Sep 17 00:00:00 2001 From: Chris Green Date: Mon, 19 Oct 2026 09:32:39 -0500 Subject: [PATCH 1/2] ci(guardrail): add repository variable check for audit alert - Change the slack-alert job condition to check `vars.GUARDRAIL_AUDIT_ALERT_ENABLED == 'true'` instead of only excluding dependabot - This enables the guardrail audit alert only when explicitly enabled via a repository variable - The workflow now requires explicit opt-in per repository/fork to send Slack messages BREAKING-CHANGE: Guardrail push alerts now require setting the GUARDRAIL_AUDIT_ALERT_ENABLED repository variable to 'true' to function --- .github/workflows/guardrail-audit-alert.yaml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/guardrail-audit-alert.yaml b/.github/workflows/guardrail-audit-alert.yaml index b503112cd..7560ba409 100644 --- a/.github/workflows/guardrail-audit-alert.yaml +++ b/.github/workflows/guardrail-audit-alert.yaml @@ -1,3 +1,15 @@ +################################################################################ +# guardrail-audit-alert +# +# Detect when commits are pushed directly to `main` rather than via PR. +# +# Set a repository variable `GUARDRAIL_AUDIT_ALERT_ENABLED' to true in +# the repository or fork for which you wish to enable this alert. +# +# The fork owner is responsible for setting the SLACK_WEBHOOK_URL +# appropriately to allow a message to be sent to the appropriate +# workspace and channel. +################################################################################ name: Guardrail Push Alerts on: push: @@ -7,7 +19,7 @@ jobs: slack-alert: runs-on: ubuntu-latest permissions: {} # Explicitly drops all token permissions - if: github.actor != 'dependabot[bot]' + if: vars.GUARDRAIL_AUDIT_ALERT_ENABLED == 'true' && github.actor != 'dependabot[bot]' steps: - name: Process and Format Slack Alert env: From 9c85fa4735394ff165b47b5fedae1c687df9a51a Mon Sep 17 00:00:00 2001 From: Chris Green Date: Mon, 19 Oct 2026 09:47:29 -0500 Subject: [PATCH 2/2] Fix minor punctuation typo in documentation comments --- .github/workflows/guardrail-audit-alert.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/guardrail-audit-alert.yaml b/.github/workflows/guardrail-audit-alert.yaml index 7560ba409..f6adb643e 100644 --- a/.github/workflows/guardrail-audit-alert.yaml +++ b/.github/workflows/guardrail-audit-alert.yaml @@ -3,7 +3,7 @@ # # Detect when commits are pushed directly to `main` rather than via PR. # -# Set a repository variable `GUARDRAIL_AUDIT_ALERT_ENABLED' to true in +# Set a repository variable `GUARDRAIL_AUDIT_ALERT_ENABLED` to true in # the repository or fork for which you wish to enable this alert. # # The fork owner is responsible for setting the SLACK_WEBHOOK_URL