chore(deps): update stranske/workflows digest to c2537cc

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
stranske/Workflows (changelog)	action	digest	d68de19 → c2537cc

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

📝 Walkthrough

Walkthrough

The agents-guard.yml workflow is updated to pin the stranske/Workflows/.github/actions/setup-api-client action to a new commit SHA in both the pull_request_target and pull_request fallback steps.

Changes

CI Action Version Bump

Layer / File(s)	Summary
Update setup-api-client SHA in both event paths .github/workflows/agents-guard.yml	The uses: reference for the fallback setup-api-client action is updated to the new pinned commit SHA in both the pull_request_target (line 114) and pull_request (line 183) fallback steps.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: updating a dependency digest in the workflow file, which matches the changeset modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/stranske-workflows-digest

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[agents-workflows-bot]

Workflow source needed

PR #111 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: Replace the pinned commit SHA reference with the version tag in the
setup-api-client action. Change the uses statement for
stranske/Workflows/.github/actions/setup-api-client from the pinned SHA
`c2537cc959f2ce05926c4639d25b90678abc97bc` to `@v1` so the action will
automatically pull updates when the v1 tag moves forward in the source
repository.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 44a412c8-4d34-4a5f-be67-7383808e879d

📥 Commits

Reviewing files that changed from the base of the PR and between 561ff57 and 40f0bf5.

📒 Files selected for processing (1)

• .github/workflows/agents-guard.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)
• stranske/Template (auto-detected)

📜 Review details

🧰 Additional context used

📓 Path-based instructions (3)

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

startup_failure in GitHub Actions workflows with zero jobs indicates GitHub couldn't parse the workflow; check for invalid YAML syntax, conflicting permissions: blocks on workflow_call reusable workflows, invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

agents-*.yml workflow files should be fixed in Workflows first, not edited locally in the consumer repo

Files:

• .github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Template, stranske/Workflows

Perfect! I have the critical cross-repo context needed for the review.

Linked repositories findings

stranske/Template (Consumer Repository) [::stranske/Template::]

Workflow consumers of the setup-api-client action:

The stranske/Template repository is a consumer of the stranske/Workflows repository and uses the setup-api-client action in its .github/workflows/agents-guard.yml file with a pinned SHA reference:

1. Line 114 — Pull request target fallback step:

   uses: "stranske/Workflows/.github/actions/setup-api-client@6deed4d3937adab2370b4ddf96046ed295efe68f" # v1

2. Line 183 — Pull request event fallback step:

   uses: "stranske/Workflows/.github/actions/setup-api-client@6deed4d3937adab2370b4ddf96046ed295efe68f" # v1

stranske/Workflows (Source Repository) [::stranske/Workflows::]

The source repository uses a tag-based reference instead of a pinned SHA:

1. Line 103 — Pull request target fallback step:

   uses: "stranske/Workflows/.github/actions/setup-api-client@v1"

2. Line 173 — Pull request event fallback step:

   uses: "stranske/Workflows/.github/actions/setup-api-client@v1"

Key Finding: Version Pinning Mismatch

Critical observation: The source repository (stranske/Workflows) uses a tag reference @v1, while the consumer repository (stranske/Template) is pinned to a specific SHA 6deed4d. This creates a divergence:

• If the PR updates the setup-api-client action implementation and moves the v1 tag to a new SHA, stranske/Workflows will automatically use the new version
• stranske/Template will continue using the old SHA 6deed4d since it's explicitly pinned, creating inconsistent behavior between source and consumer
• The fallback steps serve as safety mechanisms when the local action is unavailable, so version mismatches could cause workflow failures or unexpected behavior

Recommendation for review: Ensure that if this PR updates the action implementation, a corresponding update is needed in stranske/Template to pin to the same new SHA, or both repositories should adopt a consistent versioning strategy (either both use tags or both use specific SHAs).

🔇 Additional comments (1)

.github/workflows/agents-guard.yml (1)

114-114: AI summary contains incorrect SHA.

The AI-generated summary states the new SHA is d68de1904bcdbe16bfe2462b73aa18f41f8a0a47, but the actual code shows both fallback steps are updated to c2537cc959f2ce05926c4639d25b90678abc97bc. The changes themselves are correct and consistent across both event paths.

Also applies to: 183-183

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: The agents-guard.yml workflow file is sync-managed and should not be
edited directly in this repository. Revert the SHA changes on lines 114 and 183
(in the stranske/Workflows action references), then instead make these updates
in the source Workflows repository where the setup-api-client action is defined.
The changes will be automatically propagated to this repository through the sync
mechanism defined in .github/sync-manifest.yml, preventing drift and conflicts.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ce604db1-ea40-42c4-9894-2bf89d7d051e

📥 Commits

Reviewing files that changed from the base of the PR and between 40f0bf5 and d65ef69.

📒 Files selected for processing (1)

• .github/workflows/agents-guard.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)
• stranske/Template (auto-detected)

📜 Review details

🧰 Additional context used

📓 Path-based instructions (5)

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

startup_failure in GitHub Actions workflows with zero jobs indicates GitHub couldn't parse the workflow; check for invalid YAML syntax, conflicting permissions: blocks on workflow_call reusable workflows, invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main by default unless intentionally pinning to an exact commit SHA for a documented reason

Files:

• .github/workflows/agents-guard.yml

{.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**,docs/**}

📄 CodeRabbit inference engine (CLAUDE.md)

Synced workflows, prompts, scripts, and consumer docs are managed through .github/sync-manifest.yml in Workflows and should not be edited locally

Files:

• .github/workflows/agents-guard.yml

**/.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-guard.yml

{**/.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**,docs/ops/CONSUMER_REPO_MAINTENANCE.md,docs/keepalive/Agents.md}

📄 CodeRabbit inference engine (AGENTS.md)

Synced workflows, prompts, scripts, and consumer docs (including agents-*.yml, autofix.yml, .github/codex/ prompts, and synced scripts) are managed through .github/sync-manifest.yml in Workflows and should not be edited locally; fix issues in Workflows instead.

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Template, stranske/Workflows

Based on the results I was able to retrieve before the syntax errors, I have enough information to complete the research. Let me analyze what I found:

Linked repositories findings

stranske/Template (Consumer Repository) [::stranske/Template::]

Critical finding - Version pinning mismatch:

The stranske/Template repository uses the setup-api-client action from stranske/Workflows with an explicitly pinned SHA in .github/workflows/agents-guard.yml:

• Line 114 — Pull request target fallback step:

  uses: "stranske/Workflows/.github/actions/setup-api-client@d68de1904bcdbe16bfe2462b73aa18f41f8a0a47" # v1

• Line 183 — Pull request event fallback step:

  uses: "stranske/Workflows/.github/actions/setup-api-client@d68de1904bcdbe16bfe2462b73aa18f41f8a0a47" # v1

The pinned SHA is d68de19 (abbreviated from d68de1904bcdbe16bfe2462b73aa18f41f8a0a47).

stranske/Workflows (Source Repository - This PR) [::stranske/Workflows::]

According to the PR context, this update changes the action dependency from digest d68de19 to c2537cc.

Impact Analysis:

1. After this PR merges, stranske/Workflows will point to SHA c2537cc
2. stranske/Template remains pinned to SHA d68de19 — it will not automatically update because it uses an explicit SHA reference rather than a tag
3. This creates a version divergence: the fallback steps in both repositories will execute different implementations of the setup-api-client action
4. If the update from d68de19 to c2537cc includes breaking changes or behavioral differences, Template workflows may fail or behave unexpectedly when they fall back to the remote action

Recommendation for review: This PR should be accompanied by a corresponding update to stranske/Template to pin its setup-api-client references to the new SHA c2537cc to maintain consistency, OR the repositories should adopt a unified versioning strategy (using tags like @v1 instead of pinned SHAs) so updates propagate automatically.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Do not update sync-managed agents-guard.yml directly in this repo.

Line 114 and Line 183 modify a workflow file that is explicitly managed via .github/sync-manifest.yml; this local SHA bump should be made in the Workflows source and propagated by sync, otherwise it will drift or be overwritten.

As per coding guidelines, "Synced workflows ... are managed through .github/sync-manifest.yml in Workflows and should not be edited locally; fix issues in Workflows instead."

Also applies to: 183-183

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/agents-guard.yml at line 114, The agents-guard.yml
workflow file is sync-managed and should not be edited directly in this
repository. Revert the SHA changes on lines 114 and 183 (in the
stranske/Workflows action references), then instead make these updates in the
source Workflows repository where the setup-api-client action is defined. The
changes will be automatically propagated to this repository through the sync
mechanism defined in .github/sync-manifest.yml, preventing drift and conflicts.

Source: Coding guidelines

[stranske]

Superseded by the Workflows source-of-truth path: stranske/Workflows#2472 and stranske/Workflows#2498 have merged, and replacement sync PR #121 now carries this generated workflow update without the consumer-local synced-file review debt.