6c99372c52
Resolves issue where supply-chain-verify.yml ran before docker-build.yml completed, causing verification to skip on PRs because Docker image didn't exist yet. **Root Cause:** Both workflows triggered independently on PR events with no dependency, running concurrently instead of sequentially. **Solution:** Add workflow_run trigger to supply-chain-verify that waits for docker-build to complete successfully before running. **Changes:** - Remove pull_request trigger from supply-chain-verify.yml - Add workflow_run trigger for "Docker Build, Publish & Test" - Add job conditional checking workflow_run.conclusion == 'success' - Update tag determination to handle workflow_run context - Extract PR number from workflow_run metadata - Update PR comment logic for workflow_run events - Add debug logging for workflow_run context - Document workflow_run depth limitation **Behavior:** - PRs: docker-build → supply-chain-verify (sequential) - Push to main: docker-build → supply-chain-verify (sequential) - Failed builds: verification skipped (correct behavior) - Manual triggers: preserved via workflow_dispatch - Scheduled runs: preserved for weekly scans **Security:** - Workflow security validated: LOW risk - workflow_run runs in default branch context (prevents privilege escalation) - No secret exposure in logs or comments - Proper input sanitization for workflow metadata - YAML validation passed - Pre-commit hooks passed **Testing:** - YAML syntax validated - All references verified correct - Regression testing completed (no breaking changes) - Debug instrumentation added for validation **Documentation:** - Implementation summary created - QA report with security audit - Plan archived for reference - Testing guidelines provided Related: #461 (PR where issue was discovered) Resolves: Supply chain verification skipping on PRs Co-authored-by: GitHub Copilot <copilot@github.com>
Implementation Documentation Archive
This directory contains archived implementation documentation and historical records of feature development in Charon.
Purpose
These documents serve as historical references for:
- Feature implementation details and decisions
- Migration summaries and upgrade paths
- Investigation reports and debugging sessions
- Phase completion records
Document Index
Documents will be organized here after migration from the project root:
| Document | Description |
|---|---|
AGENT_SKILLS_MIGRATION_SUMMARY.md |
Agent skills system migration details |
BULK_ACL_FEATURE.md |
Bulk ACL feature implementation |
I18N_IMPLEMENTATION_SUMMARY.md |
Internationalization implementation |
IMPLEMENTATION_SUMMARY.md |
General implementation summary |
INVESTIGATION_SUMMARY.md |
Investigation and debugging records |
ISSUE_16_ACL_IMPLEMENTATION.md |
Issue #16 ACL implementation details |
PHASE_*_COMPLETE.md |
Phase completion documentation |
QA_*.md |
QA audit and verification reports |
SECURITY_*.md |
Security implementation records |
WEBSOCKET_FIX_SUMMARY.md |
WebSocket fix implementation |
Note
These are historical implementation records. For current documentation, refer to:
/docs/- Main documentation/README.md- Project overview/CONTRIBUTING.md- Contribution guidelines/CHANGELOG.md- Version history