ci(conductor): spec-author 重钉 v1.4.3（irRef 事件真值覆写，.github#162 根因修复，ADR-0050）

[randypanding]

CI-Workflows PR #52（tag v1.4.3 = 4676c98）已合并：spec-author 的 g010 升级为 taskId/irRef 事件真值复核+确定性覆写（.github#162 的 Cloudbird-Software/<repo>#3 占位符根因）。本 PR 把 conductor 的 uses 钉点与 ciw_ref 同步重钉（ADR-0043 钉源模式：两值必须同值）。

发版注意：v1.4.3 仅改 spec-author 链路，org-gate 未动——org-required-workflows ruleset 仍钉 v1.4.2，drift §15 不受影响；v1 大版本指针已移至 v1.4.3（§11 不变式 vN==最高，API 实操作）。

Card: Cloudbird-Software/.github#161

[coderabbitai]

Warning

Review limit reached

@randypanding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 3 minutes

Limit details: You’ve used all 10 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 67d8843b-caca-49e3-bfe1-c64910a7637d

📥 Commits

Reviewing files that changed from the base of the PR and between b0e87f3 and 58a6ccc.

📒 Files selected for processing (1)

• .github/workflows/conductor.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Repin conductor spec-author workflow to CI-Workflows v1.4.3 SHA

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Repin spec-author reusable workflow to CI-Workflows v1.4.3 commit SHA.
• Keep uses ref and ciw_ref input identical per ADR-0043 pin-source invariant.
• Pull in irRef/taskId event truth override fix (root cause of .github#162).

Diagram

graph TD
  A["GitHub Event"] --> B["route job"] --> C["spec-author job"] --> D["CI-Workflows: spec-author.yml@4676c98"] --> E["Target repo: Cloudbird-Software/.github"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin by signed tag (e.g., @v1.4.3) instead of raw SHA

• ➕ More readable and aligns with release semantics
• ➕ Easier bulk upgrades across repos
• ➖ Weaker immutability than SHA unless combined with tag-protection/signing verification
• ➖ May violate existing ADR pin-source requirements if they mandate SHA

2. Single-source the pin via workflow input/env (avoid duplicating SHA)

• ➕ Eliminates risk of uses ref and ciw_ref drifting
• ➕ Makes future repins a one-line change
• ➖ Still requires a mechanism to inject the value into both uses and with (YAML limitations)
• ➖ May conflict with the explicitness intended by the current ADR guidance

3. Call CI-Workflows once and derive ciw_ref internally (remove ciw_ref input)

• ➕ Removes duplicated pin entirely; caller only pins uses
• ➕ Reduces surface area for misconfiguration
• ➖ Requires a breaking change (interface change) to CI-Workflows spec-author reusable workflow
• ➖ Harder to audit from the caller side if downstream needs the ref for logging/traceability

Recommendation: Current approach (repin both uses and ciw_ref to the same commit SHA) is the best fit given ADR-0043/0050 supply-chain pinning constraints and keeps the invariant explicit/auditable. If drift between the two pins has been a recurring issue, consider a follow-up to reduce duplication (e.g., redesign the reusable workflow interface to not require ciw_ref).

Files changed (1) +2 / -2

Other (1) +2 / -2

conductor.ymlRepin spec-author reusable workflow and ciw_ref to v1.4.3 SHA +2/-2

Repin spec-author reusable workflow and ciw_ref to v1.4.3 SHA

• Updates the 'uses:' reference for the spec-author reusable workflow to the CI-Workflows v1.4.3 commit SHA. Keeps the passed 'ciw_ref' input in lockstep with the 'uses' pin to satisfy the ADR-0043 pin-source invariant and pick up the irRef/taskId event truth override fix.

.github/workflows/conductor.yml

[Copilot]

Pull request overview

This PR updates the Conductor workflow to pin the spec-author reusable workflow to CI-Workflows v1.4.3 (commit 4676c980...), aligning the uses ref and the ciw_ref input per the “pin-source” invariant (ADR-0043). This brings in the upstream fix that re-validates and deterministically overrides irRef/taskId based on event truth, addressing the .github#162 placeholder root cause.

Changes:

• Re-pin Cloudbird-Software/CI-Workflows/.github/workflows/spec-author.yml from 1cae5c81... to 4676c980... (v1.4.3).
• Update ciw_ref to match the new pinned uses commit SHA.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can tweak Display preferences with a live preview to see your comment before it ships

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗