/
/
/
# What does this implement/fix? The dependency security check installs the environment first and only resolves the target branch about a minute later. Most of the ~300 packages are not pinned to an exact version, so a release published in that window makes the two disagree: the check then sees a version the target branch "does not have" and blames the PR for a vulnerability it never touched. That produces a hard, non-overridable failure on an innocent PR, only clearable by re-running the job. The PR's own dependency set is now resolved right next to the target branch's, and a finding only gates when that resolution carries it too. The window shrinks from about a minute to a second, and anything left over errs towards reporting a finding instead of blocking on it. **Related issue (if applicable):** - follow-up to #5424 ## Types of changes - [ ] Bugfix (non-breaking change which fixes an issue) — `bugfix` - [ ] New feature (non-breaking change which adds functionality) — `new-feature` - [ ] Enhancement to an existing feature — `enhancement` - [ ] New music/player/metadata/plugin provider — `new-provider` - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) — `breaking-change` - [ ] Refactor (no behaviour change) — `refactor` - [ ] Documentation only — `documentation` - [ ] Maintenance / chore — `maintenance` - [x] CI / workflow change — `ci` - [ ] Dependencies bump — `dependencies` ## Changes - Resolve both branches back to back in the audit workflow instead of the target branch alone (~2s extra, no second install) - Gate a finding only when the PR's own resolution contains that exact package and version - Keep the previous behaviour when that resolution is unavailable - Fail loudly rather than silently clearing findings when a resolution cannot be read - Reword the report line for findings a PR does not introduce, which no longer always means the target branch has them ## Checklist - [x] The code change is tested and works locally. - [x] `pre-commit run --all-files` passes. - [x] `pytest` passes, and tests have been added/updated under `tests/` where applicable. - [ ] For changes to shared models, the companion PR in `music-assistant/models` is linked. - [ ] For changes affecting the UI, the companion PR in `music-assistant/frontend` is linked. - [x] I have read and complied with the project's [AI Policy](https://github.com/music-assistant/.github/blob/main/AI_POLICY.md) for any AI-assisted contributions. - [ ] I have [raised a PR against the documentation repository](https://github.com/music-assistant/music-assistant.io/blob/main/CONTRIBUTING.md) targeting the main or beta branch as appropriate.