chore(deps): update stranske/workflows digest to 44965d8 - #2035
renovate[bot] wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughTwo lines in ChangesAction Pin Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 80efea9a67
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| steps.eligibility.outputs.should-run == 'true' && | ||
| steps.api_client_base.outputs.available != 'true' | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@62ed0a86b5d57062ac3d04f4519e3998858e2d96" # v1 | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@44965d8d784573c119fb63828c05c89256c5f3e1" # v1 |
There was a problem hiding this comment.
This repo's AGENTS.md says agents-*.yml files are Workflows-owned and must be fixed in stranske/Workflows first; this updates only the consumer copy. I checked the upstream Workflows compare for 62ed0a8..44965d8, and the source consumer template still pins this fallback action to 62ed0a8, so this change creates template drift that the next sync will revert or keep reporting as divergence. Please update the Workflows template/sync source first, then sync this file.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: The pin bump modification to the setup-api-client action in
agents-guard.yml at line 114 (and line 183) should not be edited locally in this
consumer repository since this is a synced workflow file. Instead, revert both
of these pin changes in agents-guard.yml and make the same pin bump change in
the source repository at stranske/Workflows, then allow the workflow
synchronization mechanism to propagate the update to this consumer copy
automatically.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b50561c6-2df6-4f0d-bf9e-5250180a5ba3
📒 Files selected for processing (1)
.github/workflows/agents-guard.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Workflows(auto-detected)stranske/Template(auto-detected)
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Integration Tests
🧰 Additional context used
📓 Path-based instructions (3)
.github/workflows/**/*.yml
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Do not use top-level permissions block on workflow_call reusable workflows as it conflicts with caller permissions
Files:
.github/workflows/agents-guard.yml
.github/workflows/*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Reference reusable workflows with
@mainby default unless intentionally pinning to a specific commit SHA for a controlled reasonReference reusable workflows with
@mainin first-party consumers unless intentionally pinning to an exact commit SHA for a documented reason
Files:
.github/workflows/agents-guard.yml
.github/workflows/agents-*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Synced workflows (
agents-*.yml), autofix logic, prompts, scripts, and consumer docs are managed through.github/sync-manifest.ymlin stranske/Workflows and should not be edited locally — fix issues in the Workflows source repository insteadEdit agent workflow files (
agents-*.yml) instranske/Workflows, not in the consumer repo
Files:
.github/workflows/agents-guard.yml
🔀 Multi-repo context stranske/Workflows, stranske/Template
Linked repositories findings
stranske/Workflows [::stranske/Workflows::]
GitHub Action: setup-api-client
The PR updates a pinned reference to stranske/Workflows/.github/actions/setup-api-client. This action was updated as part of commit dfe0854 (fix: harden synced design system helpers #2511``), which synchronized the action definition across the Workflows repository and its consumer template.
Action Interface (Backward Compatible):
Inputs (all required: false):
secrets: JSON-encoded secrets objectgithub_token: Primary GitHub token- Individual secret fallbacks:
service_bot_pat,actions_bot_pat,owner_pr_pat,agents_automation_pat - App credentials:
workflows_app_id,workflows_app_private_key,keepalive_app_id,keepalive_app_private_key,gh_app_id,gh_app_private_key,app_1_id/id_private_key,app_2_id/id_private_key - Configuration:
install_dir,skip_deps(default:'false'),verbose(default:'false')
Outputs (unchanged):
token_count: Number of tokens exported to environmentavailable_tokens: Comma-separated list of available token namessetup_contract: Redacted machine-readable setup/auth/dependency contract JSON
Template Drift Tracking (config/template-drift-allowlist.txt):
reason = Intentional divergence re-baselined 2026-06-23: root and consumer guard workflows differ for pinned consumer actions/App-token setup; root and consumer setup-api-client pins were refreshed to the current Workflows main digest 44965d8.
This confirms the version pin update was a deliberate, coordinated sync operation.
stranske/Template [::stranske/Template::]
Fallback Usage in agents-guard.yml:
The setup-api-client action is referenced as a fallback step in two scenarios:
pull_request_targetevent: Used only whensteps.api_client_base.outputs.available != 'true'pull_requestevent: Used only whensteps.api_client_head.outputs.available != 'true'
Current pinned reference:
uses: "stranske/Workflows/.github/actions/setup-api-client@62ed0a86b5d57062ac3d04f4519e3998858e2d96" # v1Local Copy Status: Template maintains its own synced copy at ./.github/actions/setup-api-client/action.yml (572 lines, identical to Workflows version). The remote reference is only invoked as a fallback when local execution is unavailable.
Invocation Pattern (both occurrences):
with:
secrets: ${{ toJSON(secrets) }}
github_token: ${{ github.token }}Risk Assessment
✅ No Breaking Changes: All action inputs are optional; outputs remain unchanged.
✅ Backward Compatible: Existing calls to the old version (62ed0a8) will work identically with the new version (44965d8).
✅ Coordinated Sync: The drift allowlist confirms this was part of a synchronized update (commit dfe0854) across both repositories, reducing risk of misalignment.
✅ Minimal Exposure: Template repo's dependence on the remote action is limited to fallback scenarios, as it maintains its own local copy.
| steps.eligibility.outputs.should-run == 'true' && | ||
| steps.api_client_base.outputs.available != 'true' | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@62ed0a86b5d57062ac3d04f4519e3998858e2d96" # v1 | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@44965d8d784573c119fb63828c05c89256c5f3e1" # v1 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift
Move this pin bump to the Workflows source repo, not this consumer copy.
Line 114 and Line 183 modify a synced agents-*.yml workflow locally. This change should be made in stranske/Workflows and propagated via sync; otherwise it risks drift/overwrite in consumers.
As per coding guidelines: “Edit agent workflow files (agents-*.yml) in stranske/Workflows, not in the consumer repo” and “Synced workflows (agents-*.yml) ... should not be edited locally — fix issues in the Workflows source repository instead.”
Also applies to: 183-183
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-guard.yml at line 114, The pin bump modification to
the setup-api-client action in agents-guard.yml at line 114 (and line 183)
should not be edited locally in this consumer repository since this is a synced
workflow file. Instead, revert both of these pin changes in agents-guard.yml and
make the same pin bump change in the source repository at stranske/Workflows,
then allow the workflow synchronization mechanism to propagate the update to
this consumer copy automatically.
Source: Coding guidelines
|
Closing as superseded: this Renovate PR directly edits the managed synced workflow file |
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
1 participant
This PR contains the following updates:
62ed0a8→44965d8Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
Summary by CodeRabbit