chore(deps): update stranske/workflows digest to a525e6e

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
stranske/Workflows (changelog)	action	digest	6c3391d → a525e6e

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

📝 Walkthrough

Walkthrough

The workflow updates the pinned stranske/Workflows/.github/actions/setup-api-client commit SHA in both fallback setup steps for pull_request_target and pull_request.

Changes

Workflow fallback pin update

Layer / File(s)	Summary
Update fallback action pins .github/workflows/agents-guard.yml	Both fallback setup steps update the uses: pin for stranske/Workflows/.github/actions/setup-api-client to a new commit SHA.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related issues

• Dependency Dashboard Fine-Art-Archive#80: Both changes update the pinned stranske/Workflows GitHub Actions reference in workflow automation.

Possibly related PRs

• stranske/Pension-Data#584: Updates the same agents-guard.yml fallback steps by bumping the pinned stranske/Workflows/.github/actions/setup-api-client SHA.
• stranske/Pension-Data#588: Changes the same workflow file and the same pinned action reference in the pull_request_target and pull_request fallback steps.

Suggested labels

automated

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the digest update to stranske/Workflows and matches the PR's main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/stranske-workflows-digest

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[stranske-keepalive]

Workflow source needed

PR #626 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: The fallback SHA pin in the synced agents workflow should not be
updated only in this consumer repo. Revert or leave the local `agents-guard.yml`
pin as-is here, and first make the corresponding change in the upstream
`stranske/Workflows` source workflow so the synced `setup-api-client` reference
stays aligned. Check the matching fallback steps in `agents-guard.yml` and keep
the consumer file consistent with the upstream `agents-*.yml` workflow pattern.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6e8e43c4-0517-4ee5-9c5d-9c4c71ec53b8

📥 Commits

Reviewing files that changed from the base of the PR and between cc4e12d and 7426e41.

📒 Files selected for processing (1)

• .github/workflows/agents-guard.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: classify changed paths
• GitHub Check: one-pdf-pilot-golden
• GitHub Check: replay-gate
• GitHub Check: foundation-fixture-e2e
• GitHub Check: postgres-integration

🧰 Additional context used

📓 Path-based instructions (2)

**/.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows from stranske/Workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-guard.yml

{**/.github/workflows/agents-*.yml,**/.github/workflows/autofix.yml,**/.github/codex/**}

📄 CodeRabbit inference engine (CLAUDE.md)

For synced workflows, prompts, scripts, and consumer docs (e.g., agents-*.yml, autofix.yml, .github/codex/ prompts) — fix them in stranske/Workflows first, not locally in the consumer repo.

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Workflows

Linked repositories findings

stranske/Workflows [::stranske/Workflows::]

• .github/workflows/agents-guard.yml:103 and :173 — the fallback uses: pins stranske/Workflows/.github/actions/setup-api-client to 6c3391d38bbc20a4577ac42b9aa6c9dc4e462c09. This PR only updates that digest; the surrounding step inputs stay secrets: ${{ toJSON(secrets) }} and github_token: ${{ github.token }}.
• .github/actions/setup-api-client/action.yml — the shared action contract is broad but unchanged in the inspected file: it still exposes the same inputs (secrets, github_token, PAT/App secrets, install_dir, skip_deps, verbose) and outputs (token_count, available_tokens, setup_contract).
• tests/workflows/test_setup_api_client_contract.py:1-20 — the contract test asserts the setup_contract output wiring and key script markers (workflows-api-client-setup/v1, available_token_names, auth_modes, dependency_state, etc.), indicating the action’s public shape is expected to remain stable across revisions.
• .github/scripts/__tests__/agents-guard.test.js:1-160 — guard tests focus on label/approval behavior, not on the pinned fallback action version, so the SHA bump is not covered as a behavior change.
• docs/WORKFLOW_GUIDE.md:106 — docs describe agents-guard.yml as relying on the shared API client/token balancer, which matches the current workflow structure and suggests this update is an implementation refresh rather than a contract change.

[coderabbitai]

📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift

Update this pin in stranske/Workflows first.

This file matches the synced agents-*.yml workflow pattern, so bumping the fallback SHA only in the consumer repo creates drift from the source workflow. The linked upstream stranske/Workflows/.github/workflows/agents-guard.yml still carries the old 6c3391d... pin at the corresponding fallback steps, so the next sync can overwrite this change. As per coding guidelines, “For synced workflows, prompts, scripts, and consumer docs (e.g., agents-*.yml, autofix.yml, .github/codex/ prompts) — fix them in stranske/Workflows first, not locally in the consumer repo.”

Also applies to: 183-183

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/agents-guard.yml at line 114, The fallback SHA pin in the
synced agents workflow should not be updated only in this consumer repo. Revert
or leave the local `agents-guard.yml` pin as-is here, and first make the
corresponding change in the upstream `stranske/Workflows` source workflow so the
synced `setup-api-client` reference stays aligned. Check the matching fallback
steps in `agents-guard.yml` and keep the consumer file consistent with the
upstream `agents-*.yml` workflow pattern.

Sources: Coding guidelines, Linked repositories

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[stranske]

Superseded by merged Workflows source updates and replacement sync PR #627 from wave sync/workflows-57b9e3dbcb23. Keeping the generated sync PR as the source-of-truth propagation path.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the stranske/Workflows a525e6e update again.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.