Skip to content

chore(deps): update stranske/workflows digest to c2537cc #575

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
renovate wants to merge 1 commit into from
Closed

chore(deps): update stranske/workflows digest to c2537cc #575

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/agents-guard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ jobs:
github.event_name == 'pull_request_target' &&
steps.eligibility.outputs.should-run == 'true' &&
steps.api_client_base.outputs.available != 'true'
uses: "stranske/Workflows/.github/actions/setup-api-client@d68de1904bcdbe16bfe2462b73aa18f41f8a0a47" # v1
uses: "stranske/Workflows/.github/actions/setup-api-client@c2537cc959f2ce05926c4639d25b90678abc97bc" # v1

@coderabbitai coderabbitai Bot Jun 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify if there's documentation for the controlled SHA pinning reason

# Check for comments or documentation explaining SHA pinning strategy
rg -n -C3 'intentionally pin|controlled reason|SHA pin|fallback.*pin' .github/

# Check if there's a CONTRIBUTING or README documenting workflow sync policy
fd -t f 'CONTRIBUTING|README|WORKFLOW' -x cat {}

Repository: stranske/Pension-Data

Length of output: 50379

🏁 Script executed on selected repositories:

#!/bin/bash
# Check where agents-guard.yml exists and any version indicators
echo "=== agents-guard.yml in Pension-Data ==="
[ -f .github/workflows/agents-guard.yml ] && echo "EXISTS: .github/workflows/agents-guard.yml" || echo "NOT FOUND in Pension-Data"

echo -e "\n=== Check if agents-guard.yml exists in Workflows repo ==="
if [ -f .github/workflows/agents-guard.yml ]; then
  echo "EXISTS: .github/workflows/agents-guard.yml in Workflows repo"
fi

echo -e "\n=== Check for sync manifest or documentation about synced files ==="
[ -f config/sync-manifest.json ] && echo "=== sync-manifest.json ===" && head -50 config/sync-manifest.json || true

echo -e "\n=== Look for any references to SHA pinning strategy or controlled reasons ==="
rg -n '@[a-f0-9]{7}' .github/workflows/agents-guard.yml | head -5 || true

Repositories: stranske/Pension-Data, stranske/Workflows

Length of output: 1509

🏁 Script executed:

#!/bin/bash
# Check the Workflows version of agents-guard.yml at the critical lines
echo "=== Workflows version - lines 110-120 ==="
sed -n '110,120p' .github/workflows/agents-guard.yml

echo -e "\n=== Workflows version - lines 170-180 ==="
sed -n '170,180p' .github/workflows/agents-guard.yml

echo -e "\n=== Check if there's documentation or config about workflow syncing ==="
fd -t f 'sync|manifest|config' .github/ docs/ 2>/dev/null | grep -v '.git' | head -10

Repository: stranske/Workflows

Length of output: 1511

🏁 Script executed:

#!/bin/bash
# Read the sync gotcha guide to understand the policy
echo "=== Dual Location Sync Gotcha ==="
cat docs/guides/dual-location-sync-gotcha.md

echo -e "\n=== Check SYNC_WORKFLOW.md for sync policy ==="
head -80 docs/SYNC_WORKFLOW.md

Repository: stranske/Workflows

Length of output: 6074

Fix this change in stranske/Workflows first, not in this consumer repo.

This file (agents-guard.yml) is a synced workflow matching the pattern agents-*.yml, which per coding guidelines must be maintained in stranske/Workflows and synced to consumer repos—not locally modified. The Workflows version (line 173) references setup-api-client@v1 (tag-based), but this PR pins to a commit SHA instead. Update the source in stranske/Workflows/.github/workflows/agents-guard.yml first, then let the sync workflow propagate the change to consumer repos.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/agents-guard.yml at line 114, The agents-guard.yml
workflow is a synced file that must be maintained in the source repository
stranske/Workflows, not modified locally in this consumer repo. Instead of
changing the setup-api-client action reference in this file, update the source
workflow in stranske/Workflows/.github/workflows/agents-guard.yml to use the new
commit SHA, then let the sync workflow propagate the change to consumer
repositories automatically. Revert the local change to agents-guard.yml in this
PR.

Source: Coding guidelines

with:
secrets: ${{ toJSON(secrets) }}
github_token: ${{ github.token }}
Expand Down Expand Up @@ -180,7 +180,7 @@ jobs:
steps.eligibility.outputs.should-run == 'true' &&
github.event_name == 'pull_request' &&
steps.api_client_head.outputs.available != 'true'
uses: "stranske/Workflows/.github/actions/setup-api-client@d68de1904bcdbe16bfe2462b73aa18f41f8a0a47" # v1
uses: "stranske/Workflows/.github/actions/setup-api-client@c2537cc959f2ce05926c4639d25b90678abc97bc" # v1
with:
secrets: ${{ toJSON(secrets) }}
github_token: ${{ github.token }}
Expand Down
Loading