A passing security audit is a timestamp, not a verdict (opens in new tab)

A continuous integration job is supposed to be a function of your code. You change something, the job re-runs, and its color tells you whether the change is okay. Green means okay. That is the whole contract, and most jobs honor it. The security audit does not. I learned this watching one flip from green to red on a pull request that changed a single documentation file. The pull request touched one Markdown file. No code, no manifest, no lockfile. The kind of change that has no business faili...