chore(deps): bump stbenjam/skillsaw from 0.11.4 to 0.12.1

[dependabot]

Bumps stbenjam/skillsaw from 0.11.4 to 0.12.1.

Release notes

Sourced from stbenjam/skillsaw's releases.

v0.12.1

What's New

• Fix: Pin skillsaw version in GitHub Action to prevent breaking changes from affecting users (#256)

v0.12.0

What's New

New Features

• --no-custom-rules flag — mitigate T1 supply chain risk by disabling custom rule loading (#254)
• Hooks & settings security lint rules — new rules to detect dangerous patterns in hooks and settings configuration (#253)

Fixes

• Fix frontmatter regex accepting bogus closing delimiter (#251)
• Fix AttributeError crash with unquoted integer version field (#250)

Other

• Reorganize builtin rules to one-rule-per-file for maintainability (#238)
• Make APM skills user-invocable (#252)

v0.11.5

What's New

Features

• Add skillsaw-onboard skill and .claude-plugin manifest (#239)
• Add THREAT_MODEL.md (#240)

Fixes

• Fix unhashable FrontmatteredBlock crashing llm_fix (#245)
• Add live LLM test for skill-frontmatter fix (#246)
• Harden external repo tests and add agent-eval-harness (#222)

Docs

• Add docs for using skillsaw with other coding agents (#243)
• Spruce up Onboarding with AI section in README (#242)
• Remove Vertex AI recommended bias from LLM setup docs (#244)

Commits

• 674e62b Pin skillsaw version in GitHub Action (#256)
• 381e927 [Auto] Bump version to 0.12.0 (#255)
• d4ed762 Add --no-custom-rules flag to mitigate T1 supply chain risk (#254)
• ae13ceb Add hooks and settings security lint rules (#253)
• d827741 Reorganize builtin rules to one-rule-per-file (#238)
• dd0ca2a Make APM skills user-invocable (#252)
• 0a6836d [Auto] Fix frontmatter regex accepting bogus closing delimiter (#251)
• 2dd47e6 [Auto] Fix AttributeError crash with unquoted integer version field (#250)
• 7fd0fe4 Bump version to 0.11.5 (#247)
• 05b2de8 Add live LLM test for skill-frontmatter fix (#246)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

• Chores
  • Updated code quality and linting workflow tooling to maintain continuous integration standards.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign stleerh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• .github/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

Both GitHub Actions workflow files are updated to reference v0.12.1 of the skillsaw linting actions, upgrading from the previously pinned v0.11.4. The lint-plugins and lint-review workflows now use the newer version for their respective skillsaw step executions.

Changes

Skillsaw action version bump

Layer / File(s)	Summary
Skillsaw GitHub Action version bumps .github/workflows/lint-plugins.yml, .github/workflows/lint-review.yml	The stbenjam/skillsaw and stbenjam/skillsaw/review actions are pinned to v0.12.1 across both workflow files, upgrading from v0.11.4.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• openshift-eng/ai-helpers#505: Updates the same skillsaw action references in the same workflows, providing context for version bump patterns.
• openshift-eng/ai-helpers#509: Previous version bump of the same GitHub Actions (stbenjam/skillsaw actions) in these workflows.
• openshift-eng/ai-helpers#471: Earlier update to skillsaw action versions in the lint workflow files.

Suggested reviewers

• stbenjam
• mrunalp

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and specifically describes the main change: updating the stbenjam/skillsaw GitHub Action dependency from version 0.11.4 to 0.12.1 across workflow files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Real People Names In Style References	✅ Passed	PR only updates GitHub Actions workflow versions. No real people names used as style references in commands, documentation, or instructions. Names appear only as example data/arguments.
No Assumed Git Remote Names	✅ Passed	The PR updates GitHub Actions workflow files with no git remote operations. No hardcoded git remote names like "origin" or "upstream" are assumed in any added or modified code.
Git Push Safety Rules	✅ Passed	PR only updates GitHub Action versions (0.11.4→0.12.1) in workflow files with no git push, force push, or protected branch operations present.
No Untrusted Mcp Servers	✅ Passed	PR introduces no untrusted MCP server installations. Changes only update existing stbenjam/skillsaw GitHub Action versions (v0.11.4 to v0.12.1) with no new MCP dependencies or untrusted sources.
Ai-Helpers Overlap Detection	✅ Passed	PR modifies only GitHub Actions workflows (.github/workflows/), not ai-helpers files (plugins//commands/, plugins//skills/, agents/). Check is not applicable per Phase 1 filter.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/stbenjam/skillsaw-0.12.1

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/lint-review.yml (1)

17-22: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Missing contents: read permission for checkout.

The workflow checks out code at line 21-22, but the permissions block at lines 17-18 only grants pull-requests: write. When a permissions block is present, GitHub sets any unspecified permissions to none rather than using default permissions. The checkout action requires contents: read to access the repository.

Based on learnings, you should explicitly add contents: read to the permissions block.

🔒 Proposed fix to add contents permission

     permissions:
       pull-requests: write
+      contents: read

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lint-review.yml around lines 17 - 22, The workflow's
permissions block currently only sets "pull-requests: write" which causes
unspecified permissions to be disabled; update the permissions block to
explicitly include "contents: read" alongside "pull-requests: write" so the
actions/checkout step (the "Checkout code" step that uses
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) can access the
repository; modify the permissions entry named "permissions" to add the
"contents: read" key without removing the existing pull-requests setting.

Source: Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/lint-review.yml:
- Around line 17-22: The workflow's permissions block currently only sets
"pull-requests: write" which causes unspecified permissions to be disabled;
update the permissions block to explicitly include "contents: read" alongside
"pull-requests: write" so the actions/checkout step (the "Checkout code" step
that uses actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) can access
the repository; modify the permissions entry named "permissions" to add the
"contents: read" key without removing the existing pull-requests setting.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b995a778-15f2-44e6-90f4-3868ea2ba4cf

📥 Commits

Reviewing files that changed from the base of the PR and between 5b993b3 and ec36c67.

📒 Files selected for processing (2)

• .github/workflows/lint-plugins.yml
• .github/workflows/lint-review.yml

[openshift-ci]

rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[dependabot]

Looks like stbenjam/skillsaw is up-to-date now, so this is no longer needed.