From 019c2a9576ff3e26fd67d35cc7558c37662a3ecc Mon Sep 17 00:00:00 2001
From: AppSec Robot <AppSec Robot>
Date: Fri, 17 Feb 2023 12:46:13 -0800
Subject: [PATCH 1/2] Add PR Security pipeline workflow

---
 .github/workflows/pr-security.yaml | 32 ++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 .github/workflows/pr-security.yaml

diff --git a/.github/workflows/pr-security.yaml b/.github/workflows/pr-security.yaml
new file mode 100644
index 0000000..708a53b
--- /dev/null
+++ b/.github/workflows/pr-security.yaml
@@ -0,0 +1,32 @@
+---
+# onemedical/<repo>/.github/workflows/pr-security.yaml
+#
+# This is the workflow for distribution to repositories across the organization.
+# It will call the reusable PR security workflow, and run scans against each PR.
+name: PR Security
+
+
+# yamllint disable-line rule:truthy
+on:
+  pull_request:
+    branches: [main, master]
+
+
+permissions:
+  # Required for workflows in private repositories.
+  contents: read
+
+  # Required for SARIF results upload to GHAS.
+  security-events: write
+  actions: read
+
+
+jobs:
+  # Run the reusable workflow.
+  run-workflow:
+    name: Run Workflow
+    # yamllint disable-line rule:line-length
+    uses: onemedical/github-reusable-workflows/.github/workflows/reusable-pr-security.yaml@main
+    # The detect-secrets tool is used in some repositories, and generates false
+    # positives like the one below. Add comment to ignore.
+    secrets: inherit  # pragma: allowlist secret

From 0d9136ea1766dd58137bb2f89790cbbe23658bf5 Mon Sep 17 00:00:00 2001
From: Rechner Fox <659028+rechner@users.noreply.github.com>
Date: Wed, 1 Apr 2026 15:11:28 -0400
Subject: [PATCH 2/2] Test against nginx 1.28

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 40080df..5c45e95 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,7 @@ jobs:
   test-nginx:
     strategy:
        matrix:
-         version: [1.26.2, 1.27.1]
+         version: [1.26.2, 1.27.1, 1.28.2]
        fail-fast: false
     runs-on: "ubuntu-20.04"