chore(deps): update stranske/workflows digest to a0bf67e#883
chore(deps): update stranske/workflows digest to a0bf67e#883renovate[bot] wants to merge 1 commit into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
📜 Recent review details⏰ Context from checks skipped due to timeout. (4)
|
| Layer / File(s) | Summary |
|---|---|
Update fallback action SHA in both workflow paths .github/workflows/agents-guard.yml |
Replaces the prior pinned commit SHA for the fallback setup-api-client action with a new SHA in both workflow trigger paths. |
Estimated code review effort
🎯 1 (Trivial) | ⏱️ ~2 minutes
Suggested reviewers
- stranske
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | ✅ Passed | The title accurately describes the dependency digest update to stranske/Workflows. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Commit unit tests in branch
renovate/stranske-workflows-digest
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: The file `.github/workflows/agents-guard.yml` is a synced workflow
that should be maintained upstream in the `stranske/Workflows` repository, not
modified locally. Revert the pin update changes (updating the action reference
to use the new SHA de0849c19ac81e04dc4b1ce6f95c6ec53a4db945) from this pull
request in the agents-guard.yml file. Instead, apply the identical pin update
directly in the upstream `stranske/Workflows` repository at the corresponding
location, and allow the synchronization mechanism to propagate the change
downstream to this consumer repository automatically.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6b3f8c1f-e834-4165-ac53-9b58a56b3847
📒 Files selected for processing (1)
.github/workflows/agents-guard.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Workflows(auto-detected)stranske/Template(auto-detected)
📜 Review details
🧰 Additional context used
📓 Path-based instructions (6)
{pyproject.toml,.github/workflows/*.{yml,yaml}}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
{pyproject.toml,.github/workflows/*.{yml,yaml}}: Ensure coverage thresholds inpyproject.toml([tool.coverage.report] fail_under) match thecoverage-minsettings in CI workflow files to avoid threshold conflicts
The Manager-Database repository has a coverage threshold of 75%
Files:
.github/workflows/agents-guard.yml
.github/workflows/*.{yml,yaml}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
When a GitHub Actions workflow fails with
startup_failure, check for invalid YAML syntax, top-levelpermissions:blocks onworkflow_callreusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references
Files:
.github/workflows/agents-guard.yml
.github/workflows/**/*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Reference reusable workflows with
@mainto match first-party consumer defaults, unless intentionally pinning to an exact commit SHA for a controlled reason.
Files:
.github/workflows/agents-guard.yml
.github/workflows/agents-*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Synced workflows (
agents-*.yml,autofix.yml) should be fixed instranske/Workflows, not locally in the consumer repo.
Files:
.github/workflows/agents-guard.yml
.github/workflows/*.yml
📄 CodeRabbit inference engine (AGENTS.md)
First-party consumers should reference reusable workflows with
@mainunless intentionally pinning to an exact commit SHA for a controlled reason.
Files:
.github/workflows/agents-guard.yml
{.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**/*.{md,txt,prompt},**/*.sync.*}
📄 CodeRabbit inference engine (AGENTS.md)
Synced workflow files, agent prompts, scripts, and consumer docs should be fixed in
stranske/Workflowsthrough the sync manifest, not edited locally.
Files:
.github/workflows/agents-guard.yml
🔀 Multi-repo context stranske/Template, stranske/Workflows
Perfect! I now have comprehensive cross-repository context. Let me compile my findings:
Linked repositories findings
stranske/Template
Critical: Hardcoded pinned version references found in agents-guard.yml
The stranske/Template repository has hardcoded the OLD pinned commit SHA (a335f1af2c35b8f35d2278f56e9af78792a09bf1) of the setup-api-client action from stranske/Workflows in two locations:
-
Line 114 of
.github/workflows/agents-guard.yml— used as fallback forpull_request_targeteventuses: "stranske/Workflows/.github/actions/setup-api-client@a335f1af2c35b8f35d2278f56e9af78792a09bf1"
-
Line 183 of
.github/workflows/agents-guard.yml— used as fallback forpull_requesteventuses: "stranske/Workflows/.github/actions/setup-api-client@a335f1af2c35b8f35d2278f56e9af78792a09bf1"
[::stranske/Template::]
Impact on Template workflows:
Template's agents-guard.yml uses the fallback action in two critical security-sensitive contexts:
- pull_request_target: For safety validation on the base ref before privileged context is used
- pull_request: For the actual pull request event on the head ref
When the local .github/actions/setup-api-client action is unavailable (checked by steps.api_client_base.outputs.available and steps.api_client_head.outputs.available), the workflow falls back to the pinned stranske/Workflows version.
[::stranske/Template::]
Other affected workflows in Template:
20 workflows across Template reference stranske/Workflows in various ways:
.github/workflows/agents-guard.yml(2 pinned references).github/workflows/agents-*.yml(multiple workflows using reusable workflows and repository dispatch).github/workflows/maint-*.ymland other CI workflows
[::stranske/Template::]
Action purpose and scope:
The setup-api-client action is critical infrastructure that:
- Installs pinned
@octokitdependencies (rest, auth-app, plugin-retry, plugin-paginate-rest, lru-cache) - Exports authentication tokens to environment variables (GITHUB_TOKEN, PATs, GitHub App credentials)
- Provides a machine-readable setup contract JSON for downstream steps
- Manages vendored dependency aliases and Node PATH configuration
[::stranske/Workflows::]
Recommendation for reviewers:
After this PR updates the pinned SHA in the Workflows repository, the stranske/Template repository will need to be updated separately to use the new commit SHA (de0849c) in its fallback references at lines 114 and 183 of .github/workflows/agents-guard.yml to ensure consistency and receive any fixes or improvements included in the new version.
| steps.eligibility.outputs.should-run == 'true' && | ||
| steps.api_client_base.outputs.available != 'true' | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@a335f1af2c35b8f35d2278f56e9af78792a09bf1" # v1 | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@de0849c19ac81e04dc4b1ce6f95c6ec53a4db945" # v1 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# 1) Confirm the new commit exists in stranske/Workflows
gh api repos/stranske/Workflows/commits/de0849c19ac81e04dc4b1ce6f95c6ec53a4db945 \
--jq '{sha: .sha, date: .commit.committer.date}' || echo "Commit not found"
# 2) Ensure no leftover references to the OLD SHA anywhere in the repo
rg -n 'a335f1af2c35b8f35d2278f56e9af78792a09bf1' .github || echo "No stale old-SHA references remain"
# 3) Confirm both fallback pins now use the new SHA
rg -nP 'stranske/Workflows/\.github/actions/setup-api-client@[0-9a-f]{40}' .github/workflows/agents-guard.ymlRepository: stranske/Collab-Admin
Length of output: 511
🏁 Script executed:
#!/bin/bash
# Check if agents-guard.yml exists in stranske/Workflows
fd -n 'agents-guard\.yml' .github/workflows/
# Look for sync manifest files (commonly sync.yml, .sync-manifest.yml, etc.)
fd -n 'sync' . --type f -e yml -e yaml -e json | grep -E '(sync|manifest)' || echo "Searching for sync configuration..."
# Search for any references to sync behavior
rg -i 'sync' .github --type yml | head -20 || echo "No sync config found"Repository: stranske/Workflows
Length of output: 682
🏁 Script executed:
#!/bin/bash
# Check if there's a sync manifest in Collab-Admin
fd -n 'sync' . --type f -e yml -e yaml -e json | grep -iE '(sync|manifest)'
# Look for any documentation about sync
find . -name "README*" -o -name "SYNC*" -o -name ".sync*" | xargs cat 2>/dev/null || echo "No sync docs found"Repository: stranske/Collab-Admin
Length of output: 50379
🏁 Script executed:
#!/bin/bash
# Check if agents-guard.yml exists in stranske/Workflows
find .github/workflows -name 'agents-guard.yml' 2>/dev/null || echo "File not found in Workflows"
# Look for sync configuration files
find . -type f \( -name '*sync*' -o -name '.sync*' \) 2>/dev/null | head -20Repository: stranske/Workflows
Length of output: 1226
🏁 Script executed:
#!/bin/bash
# Look for sync-related files only
find . -type f \( -name '*sync*' -o -name '.sync*' \) 2>/dev/null
# Look at the README to understand the structure
head -50 README.md 2>/dev/null || echo "No README found"
# Check if there's a manifest or config explaining synced files
find . -name '*.json' -o -name '*.yml' -o -name '*.yaml' | xargs grep -l 'sync' 2>/dev/null | head -10Repository: stranske/Collab-Admin
Length of output: 3352
🏁 Script executed:
#!/bin/bash
# Check the sync manifest to see if agents-guard.yml is listed as a synced file
cat ./.github/sync-manifest.yml | head -100Repository: stranske/Workflows
Length of output: 5350
🏁 Script executed:
#!/bin/bash
# Check if Collab-Admin references the sync manifest or has any sync configuration
find . -name 'sync-manifest.yml' 2>/dev/null
ls -la .github/ | grep -i sync || echo "No local sync config"
# Check git config or any CI references to sync
git config --local --list 2>/dev/null | grep -i sync || echo "No sync config"Repository: stranske/Collab-Admin
Length of output: 195
🏁 Script executed:
#!/bin/bash
# Search for agents-guard in the sync manifest
grep -n "agents-guard" ./.github/sync-manifest.ymlRepository: stranske/Workflows
Length of output: 303
🏁 Script executed:
#!/bin/bash
# Get the full context for agents-guard.yml in the sync manifest
sed -n '106,115p' ./.github/sync-manifest.ymlRepository: stranske/Workflows
Length of output: 650
Synced workflow should be updated in stranske/Workflows, not locally.
Both fallback pins are updated consistently to the same SHA (de0849c…) with full 40-char digests, which is mechanically correct. However, agents-guard.yml is listed in the upstream stranske/Workflows sync manifest as a file intended for synchronization to consumer repos. Per coding guidelines, such synced files should be maintained in the source repository and synced downstream, rather than edited locally in consumers. Apply this change upstream in Workflows and allow it to propagate via the sync mechanism.
Note: stranske/Template still pins the old SHA at lines 114/183 of its agents-guard.yml and will need the same update separately.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-guard.yml at line 114, The file
`.github/workflows/agents-guard.yml` is a synced workflow that should be
maintained upstream in the `stranske/Workflows` repository, not modified
locally. Revert the pin update changes (updating the action reference to use the
new SHA de0849c19ac81e04dc4b1ce6f95c6ec53a4db945) from this pull request in the
agents-guard.yml file. Instead, apply the identical pin update directly in the
upstream `stranske/Workflows` repository at the corresponding location, and
allow the synchronization mechanism to propagate the change downstream to this
consumer repository automatically.
Source: Coding guidelines
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/stranske-workflows-digest
branch
from
90875a8 to
4b57abb
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/stranske-workflows-digest
branch
2 times, most recently
from
4b57abb to
e3c2078
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/stranske-workflows-digest
branch
2 times, most recently
from
e3c2078 to
e61644f
Compare
This PR contains the following updates:
a525e6e→a0bf67eConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.