chore(deps): update stranske/workflows digest to c2537cc - #2000
chore(deps): update stranske/workflows digest to c2537cc#2000renovate[bot] wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughThe ChangesAction Pin Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
0a0e390 to
082c78d
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: The `agents-guard.yml` file is a synced workflow that should not be
edited locally. Revert the SHA pin change for the `setup-api-client` action back
to the original value (`d68de19`) in this file. Instead, apply the SHA update
(`d68de19` → `c2537cc`) to the source workflow in the `stranske/Workflows`
repository, where it will propagate automatically through the sync mechanism
defined in `.github/sync-manifest.yml`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a681d174-c531-4229-8d1f-b314fb717245
📒 Files selected for processing (1)
.github/workflows/agents-guard.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Workflows(auto-detected)
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Integration Tests
🧰 Additional context used
📓 Path-based instructions (3)
.github/workflows/**/*.yml
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Do not use top-level permissions block on workflow_call reusable workflows as it conflicts with caller permissions
Files:
.github/workflows/agents-guard.yml
.github/workflows/*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Reference reusable workflows with
@mainby default unless intentionally pinning to a specific commit SHA for a controlled reasonReference reusable workflows with
@mainin first-party consumers unless intentionally pinning to an exact commit SHA for a documented reason
Files:
.github/workflows/agents-guard.yml
.github/workflows/agents-*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Synced workflows (
agents-*.yml), autofix logic, prompts, scripts, and consumer docs are managed through.github/sync-manifest.ymlin stranske/Workflows and should not be edited locally — fix issues in the Workflows source repository insteadEdit agent workflow files (
agents-*.yml) instranske/Workflows, not in the consumer repo
Files:
.github/workflows/agents-guard.yml
🔀 Multi-repo context stranske/Workflows
Based on my exploration of the stranske/Workflows repository, I can now provide a comprehensive analysis:
Linked repositories findings
stranske/Workflows
Setup-api-client action interface and consumers:
The setup-api-client action is a critical shared dependency across the Workflows repository. It has a well-defined interface with:
Inputs [::stranske/Workflows::]:
secrets(JSON-encoded secrets object)github_token(primary GitHub token)- Individual token parameters (service_bot_pat, actions_bot_pat, owner_pr_pat, agents_automation_pat, etc.)
install_dir(override for node dependencies)skip_deps(boolean, default false)verbose(boolean, default false)
Outputs [::stranske/Workflows::]:
token_count- Number of tokens exportedavailable_tokens- Comma-separated token namessetup_contract- Machine-readable setup contract (schema:workflows-api-client-setup/v1)
Consumers of setup-api-client action [::stranske/Workflows::]:
The action is used in the following workflows:
./.github/workflows/agents-guard.yml(lines 93-106) - Uses both local and fallback references tostranske/Workflows/.github/actions/setup-api-client@v1./.github/workflows/agents-63-issue-intake.yml- Multiple uses withsecretsandgithub_token./.github/workflows/agents-64-verify-agent-assignment.yml./.github/workflows/agents-71-codex-belt-dispatcher.yml./.github/workflows/agents-72-codex-belt-worker.yml./.github/workflows/agents-73-codex-belt-conveyor.yml./.github/workflows/agents-auto-label.yml./.github/workflows/agents-auto-pilot.yml./.github/workflows/agents-autofix-dispatcher.yml
Contract validation test [::stranske/Workflows::]:
File: ./tests/workflows/test_setup_api_client_contract.py validates that the action output includes:
- Schema identifier:
workflows-api-client-setup/v1 - Token information:
available_token_names,auth_modes - Dependency state:
octokit_rest_ready,octokit_auth_app_ready,lru_cache_ready - Credential names for GitHub Apps
Fallback reference pattern [::stranske/Workflows::]:
In agents-guard.yml (lines 98-106 for pull_request_target and similar for pull_request), the workflow uses:
uses: "stranske/Workflows/.github/actions/setup-api-client@v1"This is a fallback when the local action is unavailable, allowing downstream repositories to use this action as a cross-repo fallback.
Key dependency details [::stranske/Workflows::]:
- NPM packages pinned:
@octokit/rest@20.0.2,@octokit/plugin-retry@6.0.1,@octokit/plugin-paginate-rest@9.1.5,@octokit/auth-app@6.0.3,lru-cache@10.4.3 - Helper script:
create_vendor_aliases.jsfor managing vendored dependencies
| steps.eligibility.outputs.should-run == 'true' && | ||
| steps.api_client_base.outputs.available != 'true' | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@d68de1904bcdbe16bfe2462b73aa18f41f8a0a47" # v1 | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@c2537cc959f2ce05926c4639d25b90678abc97bc" # v1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if this repo has a sync manifest that should manage agents-guard.yml
echo "=== Checking for sync configuration ==="
fd -t f 'sync-manifest' -E node_modules
echo ""
echo "=== Checking if agents-guard.yml is listed in any sync config ==="
rg -l 'agents-guard' --glob '*.yml' --glob '*.yaml' -g '!.github/workflows/*' || echo "No sync references found"
echo ""
echo "=== Checking Renovate config for action pin patterns ==="
fd -t f 'renovate' -e json -e json5 --exec cat {} \; 2>/dev/null | head -50 || echo "No Renovate config found"Repository: stranske/Portable-Alpha-Extension-Model
Length of output: 273
🏁 Script executed:
#!/bin/bash
# Check if agents-guard.yml has sync metadata
echo "=== agents-guard.yml content (first 30 lines) ==="
head -30 .github/workflows/agents-guard.yml
echo ""
echo "=== Check for sync markers in agents-guard.yml ==="
grep -i "sync\|auto.*generated\|managed" .github/workflows/agents-guard.yml | head -5 || echo "No sync markers found"Repository: stranske/Portable-Alpha-Extension-Model
Length of output: 1191
🏁 Script executed:
#!/bin/bash
# Check if agents-guard.yml exists in source repo
echo "=== Checking if agents-guard.yml exists in Workflows repo ==="
ls -la .github/workflows/agents-guard.yml 2>/dev/null || echo "File not found in Workflows repo"
echo ""
echo "=== Checking sync-manifest.yml for agents-guard ==="
if [ -f .github/sync-manifest.yml ]; then
grep -A 5 -B 5 'agents-guard' .github/sync-manifest.yml || echo "agents-guard not in sync manifest"
else
echo "sync-manifest.yml not found"
fiRepository: stranske/Workflows
Length of output: 1916
Do not edit synced workflows locally — update the source in stranske/Workflows instead.
agents-guard.yml is a synced file per .github/sync-manifest.yml in stranske/Workflows. Local edits to synced files in the consumer repository will be overwritten on the next sync operation. The SHA pin update for setup-api-client (d68de19 → c2537cc) should be applied to the source workflow in stranske/Workflows and will propagate automatically through the sync mechanism.
The SHA change itself is consistent across both trigger paths (lines 114 and 183), and the action interface remains compatible per the linked repository findings.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-guard.yml at line 114, The `agents-guard.yml` file
is a synced workflow that should not be edited locally. Revert the SHA pin
change for the `setup-api-client` action back to the original value (`d68de19`)
in this file. Instead, apply the SHA update (`d68de19` → `c2537cc`) to the
source workflow in the `stranske/Workflows` repository, where it will propagate
automatically through the sync mechanism defined in `.github/sync-manifest.yml`.
Source: Coding guidelines
|
Superseded by the Workflows source-of-truth path: stranske/Workflows#2472 and stranske/Workflows#2498 have merged, and replacement sync PR #2011 now carries this generated workflow update without the consumer-local synced-file review debt. |
1 participant
This PR contains the following updates:
d68de19→c2537ccConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.