chore(deps): update stranske/workflows digest to a335f1a

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
stranske/Workflows (changelog)	action	digest	c2537cc → a335f1a

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

• Chores
  • Updated internal workflow automation tooling.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ac349d56-e568-40e8-95cf-71b102e0fbc1

📥 Commits

Reviewing files that changed from the base of the PR and between 6f26a33 and d3d4a44.

📒 Files selected for processing (1)

• .github/workflows/agents-guard.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (2)

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.yml: Do not add top-level permissions: block on workflow_call reusable workflows - this conflicts with caller permissions
Avoid invalid YAML syntax, invalid permission scopes, and circular workflow references when creating GitHub Actions workflows

Files:

• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Agent workflow files (agents-*.yml) should be fixed in stranske/Workflows, not edited locally in the consumer repository

agents-*.yml workflow files should be fixed in stranske/Workflows, not edited locally in the consumer repo

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Workflows

Based on my exploration of the stranske/Workflows repository, I can now provide context for this PR review.

Linked repositories findings

stranske/Workflows (Primary Repository)

Setup API Client Action Overview:
The setup-api-client action that is being updated via the commit SHA pin is a composite GitHub Action located at .github/actions/setup-api-client/action.yml [::stranske/Workflows::]. It serves a critical role in workflow infrastructure:

Core Responsibilities:

1. Installs pinned @octokit dependencies (@octokit/rest@20.0.2, @octokit/plugin-retry@6.0.1, @octokit/plugin-paginate-rest@9.1.5, @octokit/auth-app@6.0.3, lru-cache@10.4.3)
2. Exports all available tokens to environment variables for API calls
3. Provides outputs: token_count, available_tokens, and setup_contract (JSON contract describing auth modes and dependency state)

Input Contract (No Breaking Changes Expected):
The action defines all inputs as required: false [::stranske/Workflows::]:

• secrets: JSON-encoded secrets object
• github_token: Primary GitHub token
• Individual token inputs (service_bot_pat, actions_bot_pat, owner_pr_pat, etc.)
• Configuration: skip_deps, verbose, install_dir

Since all inputs are optional, consumers using the fallback action reference at commit a335f1a should continue to work without modification.

Usage Context:
The action is referenced in .github/workflows/agents-guard.yml [::stranske/Workflows::] as a fallback mechanism in two workflow paths:

1. pull_request_target event: Falls back when local action unavailable
2. pull_request event: Falls back when local action unavailable

The fallback pin at stranske/Workflows/.github/actions/setup-api-client@44965d8d784573c119fb63828c05c89256c5f3e1 indicates this is a stable, reusable action expected to maintain backward compatibility.

Current Version:
The current HEAD (a335f1a) is tagged as version 1.17.1 per the release commit "chore(main): release 1.17.1 (#2512)" [::stranske/Workflows::].

🔇 Additional comments (1)

.github/workflows/agents-guard.yml (1)

114-114: Duplicate of existing review: local edit to centrally managed agents-*.yml

This was already flagged and still applies: this update should be made in stranske/Workflows, not in the consumer repository copy.

As per coding guidelines, “.github/workflows/agents-*.yml: Agent workflow files (agents-*.yml) should be fixed in stranske/Workflows, not edited locally in the consumer repository.”

Also applies to: 183-183

Source: Coding guidelines

---

📝 Walkthrough

Walkthrough

Two lines in .github/workflows/agents-guard.yml are updated to pin stranske/Workflows/.github/actions/setup-api-client to a new commit SHA. Both the pull_request_target and pull_request "Workflows fallback" steps receive the same new SHA; no other logic or inputs are changed.

Changes

Action SHA Pin Update

Layer / File(s)	Summary
Update setup-api-client SHA in both workflow triggers .github/workflows/agents-guard.yml	The uses: pin for stranske/Workflows/.github/actions/setup-api-client is updated to a new commit SHA in both the pull_request_target fallback step (line 114) and the pull_request fallback step (line 183). Step conditions and inputs are unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• stranske/Counter_Risk#757: Updates the same .github/workflows/agents-guard.yml "Workflows fallback" steps to pin stranske/Workflows/.github/actions/setup-api-client to a new commit SHA, identical change pattern.
• stranske/Counter_Risk#751: Updates pinned GitHub Action commit digests in workflow YAML files, same type of SHA bump with no workflow logic changes.

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: updating a dependency digest for stranske/Workflows to a specific commit SHA.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/stranske-workflows-digest

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[stranske-keepalive]

Workflow source needed

PR #787 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: Remove the modifications to the agents-guard.yml file (specifically
the setup-api-client action reference update at line 114 and line 183) from this
pull request, as agent workflow files should not be edited locally in the
consumer repository. Instead, apply these same changes to the corresponding
agents-guard.yml file in the centralized stranske/Workflows repository, which is
the source of truth for all agents-*.yml workflow files. Once the changes are
merged there, the consumer repository will automatically use the updated action
reference.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f5748bab-4606-4326-8aee-aa0737a9bc38

📥 Commits

Reviewing files that changed from the base of the PR and between 765e4a5 and 6f26a33.

📒 Files selected for processing (1)

• .github/workflows/agents-guard.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Review details

🧰 Additional context used

📓 Path-based instructions (2)

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.yml: Do not add top-level permissions: block on workflow_call reusable workflows - this conflicts with caller permissions
Avoid invalid YAML syntax, invalid permission scopes, and circular workflow references when creating GitHub Actions workflows

Files:

• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Agent workflow files (agents-*.yml) should be fixed in stranske/Workflows, not edited locally in the consumer repository

agents-*.yml workflow files should be fixed in stranske/Workflows, not edited locally in the consumer repo

Files:

• .github/workflows/agents-guard.yml

[coderabbitai]

📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift

Move this agents-guard.yml change to stranske/Workflows instead of patching locally.

Line 114 and Line 183 update an agents-*.yml workflow in the consumer repository, which breaks the repo’s workflow ownership rule and risks divergence from the centrally managed source.

As per coding guidelines, “.github/workflows/agents-*.yml: Agent workflow files (agents-*.yml) should be fixed in stranske/Workflows, not edited locally in the consumer repository.”

Also applies to: 183-183

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/agents-guard.yml at line 114, Remove the modifications to
the agents-guard.yml file (specifically the setup-api-client action reference
update at line 114 and line 183) from this pull request, as agent workflow files
should not be edited locally in the consumer repository. Instead, apply these
same changes to the corresponding agents-guard.yml file in the centralized
stranske/Workflows repository, which is the source of truth for all agents-*.yml
workflow files. Once the changes are merged there, the consumer repository will
automatically use the updated action reference.

Source: Coding guidelines

[stranske]

Closing as superseded by Workflows source fix #2514 plus the next Maint 68 sync wave; this PR patches a managed agents-guard.yml copy directly.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the stranske/Workflows a335f1a update again.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.