chore(deps): update stranske/workflows digest to 62ed0a8

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
stranske/Workflows (changelog)	action	digest	c2537cc → 62ed0a8

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

• Chores
  • Updated internal CI/CD workflow configuration to use a newer version of the API client setup tool.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 40bff318-abac-4333-84db-1f767f547ba8

📥 Commits

Reviewing files that changed from the base of the PR and between 24c0eec and 720a010.

📒 Files selected for processing (1)

• .github/workflows/agents-guard.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: Resolve review target
• GitHub Check: replay-gate
• GitHub Check: foundation-fixture-e2e
• GitHub Check: nl-sql-golden
• GitHub Check: entity-regression

🧰 Additional context used

📓 Path-based instructions (2)

**/.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows from stranske/Workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-guard.yml

{**/.github/workflows/agents-*.yml,**/.github/workflows/autofix.yml,**/.github/codex/**}

📄 CodeRabbit inference engine (CLAUDE.md)

For synced workflows, prompts, scripts, and consumer docs (e.g., agents-*.yml, autofix.yml, .github/codex/ prompts) — fix them in stranske/Workflows first, not locally in the consumer repo.

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Workflows

Linked repositories findings

Based on the previous research already conducted and documented, I can confirm the cross-repository context for this PR:

stranske/Workflows

Action: setup-api-client (Commit c2537cc → 62ed0a8, v1.16.0)

The PR updates the pinned version of the setup-api-client composite action. This action is a critical dependency widely used across multiple workflows.

Key Findings:

1. Stable API Surface — No Breaking Changes:

   • Inputs remain unchanged: secrets, github_token, service_bot_pat, actions_bot_pat, owner_pr_pat, agents_automation_pat, workflows_app_id, workflows_app_private_key, keepalive_app_id, keepalive_app_private_key, gh_app_id, gh_app_private_key, app_1_id, app_1_private_key, app_2_id, app_2_private_key, install_dir, skip_deps, verbose [::stranske/Workflows::]
   • Outputs remain unchanged: token_count, available_tokens, setup_contract (all sourced from steps.export-tokens) [::stranske/Workflows::]
   • v1.16.0 changelog documents NO changes to setup-api-client action itself — only feature additions for LangSmith/repo-review and bug fixes in other components [::stranske/Workflows::]

2. Wide Dependency Coverage (67 workflows):

   • The action is used in both local checkout mode (uses: ./.github/actions/setup-api-client) and remote fallback mode (uses: stranske/Workflows/.github/actions/setup-api-client@v1) [::stranske/Workflows::]
   • Implementation includes detection logic that safely switches between local and remote execution paths [::stranske/Workflows::]

3. Supporting Infrastructure:

   • Action is tracked in .github/sync-manifest.yml as a unified API client setup component [::stranske/Workflows::]
   • Helper script create_vendor_aliases.js supports sparse checkout patterns [::stranske/Workflows::]

Review Conclusion:
✅ No breaking changes identified. All 67 consuming workflows across the repository should continue functioning without modification. The action's contract is stable and the version update poses no compatibility risks to consumers.

🔇 Additional comments (1)

.github/workflows/agents-guard.yml (1)

114-114: LGTM!

Also applies to: 183-183

---

📝 Walkthrough

Walkthrough

The pinned commit hash for the stranske/Workflows/.github/actions/setup-api-client fallback action is updated in two places within .github/workflows/agents-guard.yml: once for the pull_request_target trigger path and once for the pull_request trigger path.

Changes

agents-guard Workflow Action Pin

Layer / File(s)	Summary
Update setup-api-client commit pin for both PR triggers .github/workflows/agents-guard.yml	The pinned uses commit hash for stranske/Workflows/.github/actions/setup-api-client is updated on lines 114 and 183, covering both the pull_request_target and pull_request fallback steps.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• stranske/Pension-Data#584: Performs the same type of change — updating the pinned commit hash for the setup-api-client fallback step in agents-guard.yml for both pull_request_target and pull_request triggers.

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: updating the stranske/workflows dependency digest from c2537cc to 62ed0a8, which is the primary and only change in this PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/stranske-workflows-digest

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[stranske-keepalive]

Workflow source needed

PR #588 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.