chore(deps): update stranske/workflows digest to c2537cc - #575
chore(deps): update stranske/workflows digest to c2537cc#575renovate[bot] wants to merge 1 commit into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe ChangesAgents Guard Workflow SHA Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Workflow state fingerprint for Keepalive Loop Reporter. Do not edit. |
|
Workflow state fingerprint for Agents Gate Followups. Do not edit. |
Workflow source neededPR #575 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
3bb4f18 to
d53f216
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: The agents-guard.yml workflow is a synced file that must be
maintained in the source repository stranske/Workflows, not modified locally in
this consumer repo. Instead of changing the setup-api-client action reference in
this file, update the source workflow in
stranske/Workflows/.github/workflows/agents-guard.yml to use the new commit SHA,
then let the sync workflow propagate the change to consumer repositories
automatically. Revert the local change to agents-guard.yml in this PR.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ef2b22c8-d5f2-4409-aa72-4a239296b0f7
📒 Files selected for processing (1)
.github/workflows/agents-guard.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Workflows(auto-detected)
📜 Review details
🧰 Additional context used
📓 Path-based instructions (2)
**/.github/workflows/*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Reference reusable workflows from
stranske/Workflowswith@mainunless intentionally pinning to an exact commit SHA for a controlled reason.Reference reusable workflows with
@mainunless intentionally pinning to an exact commit SHA for a controlled reason.
Files:
.github/workflows/agents-guard.yml
{**/.github/workflows/agents-*.yml,**/.github/workflows/autofix.yml,**/.github/codex/**}
📄 CodeRabbit inference engine (CLAUDE.md)
For synced workflows, prompts, scripts, and consumer docs (e.g.,
agents-*.yml,autofix.yml,.github/codex/prompts) — fix them instranske/Workflowsfirst, not locally in the consumer repo.
Files:
.github/workflows/agents-guard.yml
🔀 Multi-repo context stranske/Workflows
Linked repositories findings
stranske/Workflows [::stranske/Workflows::]
Update scope:
The PR updates the setup-api-client action fallback reference in agents-guard.yml from digest d68de19 to c2537cc:
- Old version: v1.15.1 (released 2026-06-19)
- New version: v1.15.2 (released 2026-06-19)
- Fallback steps affected: Lines 103 and 173 in
agents-guard.yml
Action Implementation Unchanged:
[::stranske/Workflows::] The comparison of commits d68de19 and c2537cc confirms that the .github/actions/setup-api-client/ directory was not modified between v1.15.1 and v1.15.2. The v1.15.2 patch release included changes only to runtime merge guard logic, PR merge contract utilities, workflows, and documentation—but not to the setup-api-client action itself.
Action Contract Stability:
[::stranske/Workflows::] The setup-api-client action maintains a stable contract with schema workflows-api-client-setup/v1 and exports consistent outputs (token_count, available_tokens, setup_contract). The action's file structure remains unchanged: action.yml (572 lines) and create_vendor_aliases.js.
Usage Pattern:
[::stranske/Workflows::] The agents-guard.yml workflow uses a dual-path setup:
- Primary: Local action
./.github/actions/setup-api-client(for pull_request events with PR branch source code) - Fallback: External reference
stranske/Workflows/.github/actions/setup-api-client@v1(for pull_request_target events where base branch source is used)
The PR updates only the fallback digest, which is used when the local action is unavailable.
Risk Assessment:
This is a safe patch-level update. Since the setup-api-client action implementation and interface did not change between v1.15.1 and v1.15.2, there is no risk of breaking changes to the workflow or its API client setup contract.
| steps.eligibility.outputs.should-run == 'true' && | ||
| steps.api_client_base.outputs.available != 'true' | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@d68de1904bcdbe16bfe2462b73aa18f41f8a0a47" # v1 | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@c2537cc959f2ce05926c4639d25b90678abc97bc" # v1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify if there's documentation for the controlled SHA pinning reason
# Check for comments or documentation explaining SHA pinning strategy
rg -n -C3 'intentionally pin|controlled reason|SHA pin|fallback.*pin' .github/
# Check if there's a CONTRIBUTING or README documenting workflow sync policy
fd -t f 'CONTRIBUTING|README|WORKFLOW' -x cat {}Repository: stranske/Pension-Data
Length of output: 50379
🏁 Script executed on selected repositories:
#!/bin/bash
# Check where agents-guard.yml exists and any version indicators
echo "=== agents-guard.yml in Pension-Data ==="
[ -f .github/workflows/agents-guard.yml ] && echo "EXISTS: .github/workflows/agents-guard.yml" || echo "NOT FOUND in Pension-Data"
echo -e "\n=== Check if agents-guard.yml exists in Workflows repo ==="
if [ -f .github/workflows/agents-guard.yml ]; then
echo "EXISTS: .github/workflows/agents-guard.yml in Workflows repo"
fi
echo -e "\n=== Check for sync manifest or documentation about synced files ==="
[ -f config/sync-manifest.json ] && echo "=== sync-manifest.json ===" && head -50 config/sync-manifest.json || true
echo -e "\n=== Look for any references to SHA pinning strategy or controlled reasons ==="
rg -n '@[a-f0-9]{7}' .github/workflows/agents-guard.yml | head -5 || true
Repositories: stranske/Pension-Data, stranske/Workflows
Length of output: 1509
🏁 Script executed:
#!/bin/bash
# Check the Workflows version of agents-guard.yml at the critical lines
echo "=== Workflows version - lines 110-120 ==="
sed -n '110,120p' .github/workflows/agents-guard.yml
echo -e "\n=== Workflows version - lines 170-180 ==="
sed -n '170,180p' .github/workflows/agents-guard.yml
echo -e "\n=== Check if there's documentation or config about workflow syncing ==="
fd -t f 'sync|manifest|config' .github/ docs/ 2>/dev/null | grep -v '.git' | head -10Repository: stranske/Workflows
Length of output: 1511
🏁 Script executed:
#!/bin/bash
# Read the sync gotcha guide to understand the policy
echo "=== Dual Location Sync Gotcha ==="
cat docs/guides/dual-location-sync-gotcha.md
echo -e "\n=== Check SYNC_WORKFLOW.md for sync policy ==="
head -80 docs/SYNC_WORKFLOW.mdRepository: stranske/Workflows
Length of output: 6074
Fix this change in stranske/Workflows first, not in this consumer repo.
This file (agents-guard.yml) is a synced workflow matching the pattern agents-*.yml, which per coding guidelines must be maintained in stranske/Workflows and synced to consumer repos—not locally modified. The Workflows version (line 173) references setup-api-client@v1 (tag-based), but this PR pins to a commit SHA instead. Update the source in stranske/Workflows/.github/workflows/agents-guard.yml first, then let the sync workflow propagate the change to consumer repos.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-guard.yml at line 114, The agents-guard.yml
workflow is a synced file that must be maintained in the source repository
stranske/Workflows, not modified locally in this consumer repo. Instead of
changing the setup-api-client action reference in this file, update the source
workflow in stranske/Workflows/.github/workflows/agents-guard.yml to use the new
commit SHA, then let the sync workflow propagate the change to consumer
repositories automatically. Revert the local change to agents-guard.yml in this
PR.
Source: Coding guidelines
bd6bec6 to
3f5c2c2
Compare
3f5c2c2 to
0142495
Compare
|
Superseded by the Workflows source-of-truth path: stranske/Workflows#2472 and stranske/Workflows#2498 have merged, and replacement sync PR #583 now carries this generated workflow update without the consumer-local synced-file review debt. |
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
1 participant
This PR contains the following updates:
d68de19→c2537ccConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
Summary by CodeRabbit