ci: run dependency review and license check on stacked PRs

Merged
RE
2d ago
+2-2

Context & Requests for Reviewers

Right now our PR workflows only trigger on pull_request with branches: [main], so stacked PR (whose base is another PR branch) doesn't run dependency-review, license checks until its parent merges.

Note: this doesn't include CodeQL, which is a configuration in the repo settings rather than a workflow setting. Right now it only runs on PRs based on main. It's a little tricky to turn that on for stacked PRs, because we'd either have move to the 'advanced setup' option with a workflow file that we then maintain, or turn on branch protection for stack branches (which has a lot of consequences for usability).

It also doesn't include AgentScan or Labeler, because those use pull_request_target and I'm hesitant to expand that. This means AgentScan may never run on a stacked PR, because I believe it only triggers on open/close events. Labeler will run when the stacked PR is rebased on main.

Tests

Tested on #1479 (throw-away PR stacked on this one).

Checklist

Only check items that apply to this PR; leave the rest unchecked.

  • If you changed anything user-facing (i.e. user interface or APIs):
    Did you update related docs?

  • If the change is notable (refer to Keep a Changelog conventions):
    Did you update CHANGELOG.md?

  • If you changed db/src/scripts/** and used CREATE TABLE, ADD COLUMN, or ALTER COLUMN:
    Are as many columns marked NOT NULL as possible? If some columns can sometimes be null depending on other columns, are there CHECK constraints capturing those relationships, and are these also reflected using unions in the associated Kysely types?

  • If you added a new signal in server/services/signalsService/signals/**:
    Did you classify every error case as a permanent error (SignalPermanentError, no retry) or a normal error (retryable)? Any case where the signal can't determine a score should be a SignalPermanentError.