ci: fix security scan checks on PR runs (#2246)

Author: lkstrp

.github/workflows/security-scan.yaml

@@ -3,16 +3,34 @@ on:
   push:
     branches: [master]
     paths: [pixi.lock]
+  # No path filter, a required check must report on every PR
   pull_request:
     branches: [master]
-    paths: [pixi.lock]
   schedule:
   - cron: "0 6 * * *"
   workflow_dispatch:
 
 jobs:
+  changes:
+    name: Detect pixi.lock changes
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    outputs:
+      pixi: ${{ steps.diff.outputs.pixi }}
+    steps:
+    - id: diff
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        files=$(gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" --paginate --jq '.[].filename')
+        grep -qxF pixi.lock <<< "$files" && pixi=true || pixi=false
+        echo "pixi=$pixi" >> "$GITHUB_OUTPUT"
+
   scan:
     name: SBOM and vulnerability scan
+    needs: changes
+    # Skip only when pixi.lock is confirmed unchanged
+    if: ${{ !cancelled() && !(needs.changes.result == 'success' && needs.changes.outputs.pixi == 'false') }}
     runs-on: ubuntu-latest
     permissions:
       security-events: write
@@ -56,14 +74,13 @@ jobs:
         mv normalized.sarif "${{ steps.scan.outputs.sarif }}"
 
     - name: Upload SARIF
-      if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+      if: github.ref == 'refs/heads/master'
       uses: github/codeql-action/upload-sarif@v4
       with:
         sarif_file: ${{ steps.scan.outputs.sarif }}
         category: pixi-vuln-scan
 
-    # Fork PRs cant upload SARIF (no access to token), so code scannings native diff
-    # does not apply. This builds our own diff from a master-uploaded SARIF artifact instead.
+    # Baseline for the PR CVE diff below
     - name: Upload SARIF as artifact
       if: github.ref == 'refs/heads/master'
       uses: actions/upload-artifact@v7
@@ -72,10 +89,9 @@ jobs:
         path: ${{ steps.scan.outputs.sarif }}
         retention-days: 30
 
-    # Fork PRs cant upload SARIF to code scanning (no token write access), so
-    # diff against the master baseline artifact here instead
-    - name: Download master baseline (fork PRs only)
-      if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
+    # All PRs gate on new CVEs vs the master baseline
+    - name: Download master baseline
+      if: github.event_name == 'pull_request'
       uses: dawidd6/action-download-artifact@v21
       with:
         workflow: security-scan.yaml
@@ -84,8 +100,8 @@ jobs:
         if_no_artifact_found: fail
         path: master-baseline
 
-    - name: Fail on new CVEs (fork PRs only)
-      if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
+    - name: Fail on new CVEs
+      if: github.event_name == 'pull_request'
       env:
         SARIF_PATH: ${{ steps.scan.outputs.sarif }}
       run: |