chore(deps): Bump stbenjam/skillsaw from 0.11.4 to 0.11.5 - #527
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [stbenjam/skillsaw](https://github.com/stbenjam/skillsaw) from 0.11.4 to 0.11.5. - [Release notes](https://github.com/stbenjam/skillsaw/releases) - [Commits](stbenjam/skillsaw@c85a25e...7fd0fe4) --- updated-dependencies: - dependency-name: stbenjam/skillsaw dependency-version: 0.11.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
area/dependency
WalkthroughThe PR updates two GitHub Actions workflows to pin the ChangesSkillsaw Action Upgrade
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 10✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/lint-review.yml (1)
17-22:⚠️ Potential issue | 🟠 Major | ⚡ Quick winGrant
contents: readtoactions/checkoutin thereviewjobThis job sets
permissionsto onlypull-requests: write; with apermissionsblock, all other token scopes default tonone, soactions/checkout(line 22) needscontents: read.Suggested fix
review: if: github.event.workflow_run.event == 'pull_request' runs-on: ubuntu-latest permissions: + contents: read pull-requests: write🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/lint-review.yml around lines 17 - 22, The workflow's permissions block only sets pull-requests: write which leaves other scopes disabled, causing actions/checkout (actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) to lack the required contents access; update the permissions block that contains pull-requests: write to also include contents: read so the checkout step can read the repository (i.e., add a contents: read entry alongside pull-requests: write in the same permissions mapping).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/lint-plugins.yml:
- Around line 20-23: The workflow step currently uses
stbenjam/skillsaw@7fd0fe415cc3e3046fa0bb4d096e2c3e206b461c (v0.11.5) but the
with.version field is set to '0.11.4'; update the with.version value referenced
in the lint step to '0.11.5' so the pinned version matches the action tag (look
for the uses: stbenjam/skillsaw... line and the with.version setting).
---
Outside diff comments:
In @.github/workflows/lint-review.yml:
- Around line 17-22: The workflow's permissions block only sets pull-requests:
write which leaves other scopes disabled, causing actions/checkout
(actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) to lack the required
contents access; update the permissions block that contains pull-requests: write
to also include contents: read so the checkout step can read the repository
(i.e., add a contents: read entry alongside pull-requests: write in the same
permissions mapping).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 26478b9a-0d9d-431e-ad2c-59f35b0f5412
📒 Files selected for processing (2)
.github/workflows/lint-plugins.yml.github/workflows/lint-review.yml
| uses: stbenjam/skillsaw@7fd0fe415cc3e3046fa0bb4d096e2c3e206b461c # v0.11.5 | ||
| with: | ||
| strict: true | ||
| version: '0.11.4' |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant workflow lines with context
FILE=".github/workflows/lint-plugins.yml"
echo "== $FILE =="
nl -ba "$FILE" | sed -n '1,120p'Repository: openshift-eng/ai-helpers
Length of output: 170
🌐 Web query:
stbenjam/skillsaw GitHub Action input version strict v0.11.5 v0.11.4 what does with.version do
💡 Result:
In the stbenjam/skillsaw GitHub Action, the input with.version controls which installed skillsaw CLI version the action will fetch/install and then run. The action’s README lists the GitHub Action inputs as: - version: “Specific skillsaw version to install” with default “latest” [1]. So: - with: version: v0.11.5 (or 0.11.5, depending on how the action accepts it) will make the action install that specific skillsaw release instead of “latest”. [1] - if you don’t set version, it installs the default “latest”. [1] How this relates to your earlier mention of config “version pinning”: - Separately, skillsaw’s.skillsaw.yaml/.skillsaw config can include a version field; rules added after that config version are skipped unless you bump the config version (or explicitly enable them). That is “version pinning” inside skillsaw itself, not the GitHub Action input. [1]
Citations:
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/lint-plugins.yml"
if [ ! -f "$FILE" ]; then
echo "Missing $FILE"
exit 1
fi
echo "== $FILE =="
awk 'NR>=1 && NR<=60 {printf "%4d\t%s\n", NR, $0}' "$FILE" | sed -n '15,35p'Repository: openshift-eng/ai-helpers
Length of output: 450
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/lint-plugins.yml"
echo "== $FILE =="
if [ ! -f "$FILE" ]; then
echo "Missing $FILE"
exit 1
fi
# Print a small window around the reported lines (20-23) with line numbers
awk 'NR>=15 && NR<=30 {printf "%4d\t%s\n", NR, $0}' "$FILE"Repository: openshift-eng/ai-helpers
Length of output: 450
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/lint-plugins.yml"
echo "== $FILE =="
awk 'NR>=15 && NR<=30 {printf "%4d\t%s\n", NR, $0}' "$FILE"Repository: openshift-eng/ai-helpers
Length of output: 450
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/lint-plugins.yml"
echo "== $FILE =="
awk 'NR>=15 && NR<=30 {printf "%4d\t%s\n", NR, $0}' "$FILE"Repository: openshift-eng/ai-helpers
Length of output: 450
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/lint-plugins.yml"
wc -l "$FILE"
cat "$FILE"Repository: openshift-eng/ai-helpers
Length of output: 558
Align with.version with the bumped stbenjam/skillsaw action version. File: .github/workflows/lint-plugins.yml (lines 20-23)
The step uses stbenjam/skillsaw # v0.11.5 but pins with.version: '0.11.4', so the action will install/run skillsaw 0.11.4. Bump with.version to 0.11.5 to keep lint behavior consistent.
Suggested fix
- name: Run skillsaw
uses: stbenjam/skillsaw@7fd0fe415cc3e3046fa0bb4d096e2c3e206b461c # v0.11.5
with:
strict: true
- version: '0.11.4'
+ version: '0.11.5'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: stbenjam/skillsaw@7fd0fe415cc3e3046fa0bb4d096e2c3e206b461c # v0.11.5 | |
| with: | |
| strict: true | |
| version: '0.11.4' | |
| uses: stbenjam/skillsaw@7fd0fe415cc3e3046fa0bb4d096e2c3e206b461c # v0.11.5 | |
| with: | |
| strict: true | |
| version: '0.11.5' |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/lint-plugins.yml around lines 20 - 23, The workflow step
currently uses stbenjam/skillsaw@7fd0fe415cc3e3046fa0bb4d096e2c3e206b461c
(v0.11.5) but the with.version field is set to '0.11.4'; update the with.version
value referenced in the lint step to '0.11.5' so the pinned version matches the
action tag (look for the uses: stbenjam/skillsaw... line and the with.version
setting).
|
Dependabot is not doing it correctly |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps stbenjam/skillsaw from 0.11.4 to 0.11.5.
Release notes
Sourced from stbenjam/skillsaw's releases.
Commits
7fd0fe4Bump version to 0.11.5 (#247)05b2de8Add live LLM test for skill-frontmatter fix (#246)eddfdaaFix unhashable FrontmatteredBlock crashing llm_fix (#245)afffe80Remove Vertex AI recommended bias from LLM setup docs (#244)946d565Add docs for using skillsaw with other coding agents (#243)11d0da7Spruce up Onboarding with AI section in README (#242)252a46dAdd THREAT_MODEL.md (#240)f22f0b5Add skillsaw-onboard skill and .claude-plugin manifest (#239)bb8f83fHarden external repo tests and add agent-eval-harness (#222)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit