chore(deps): update stranske/workflows digest to c2537cc

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
stranske/Workflows (changelog)	action	digest	d68de19 → c2537cc

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 863cdbe5-067b-4b42-a3ca-1a144b4a3075

📥 Commits

Reviewing files that changed from the base of the PR and between 7fbc090 and 0a646b0.

📒 Files selected for processing (1)

• .github/workflows/agents-guard.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (4)

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.{yml,yaml}: Ensure coverage threshold settings in GitHub Actions workflow files for coverage-min match the [tool.coverage.report] fail_under setting in pyproject.toml, as the lower value will be the effective threshold
For startup_failure in GitHub Actions workflows with zero jobs, check for invalid YAML syntax, top-level permissions: blocks in workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (AGENTS.md)

Agent workflows (agents-*.yml), autofix.yml, synced prompts in .github/codex/, and synced scripts/docs should be fixed in stranske/Workflows, not in the consumer repository

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Workflows

Based on my exploration of the stranske/Workflows repository, I can now provide a summary of findings:

Linked repositories findings

stranske/Workflows

Setup-api-client action usage and impact:

The PR updates a pinned commit reference for the setup-api-client action fallback in .github/workflows/agents-guard.yml at two locations:

• Line 103: Setup API client (Workflows fallback) for pull_request_target event
• Line 173: Setup API client (Workflows fallback) for pull_request event

[::stranske/Workflows::]

Single consumer of external fallback:
Only agents-guard.yml in the repository uses the external fallback reference stranske/Workflows/.github/actions/setup-api-client@v1. All other ~50+ workflows in the repository use the local action directly (./.github/actions/setup-api-client). [::stranske/Workflows::]

Action interface stability:
The setup-api-client action defines:

• Inputs: All optional (secrets, github_token, various bot PATs, app credentials, install_dir, skip_deps, verbose)
• Outputs: token_count, available_tokens, setup_contract
• The action performs npm installation of @octokit dependencies, exports environment tokens, and generates a setup contract

These inputs and outputs are passed identically in both fallback calls (lines 94-96 and 174-176), with identical parameter patterns. [::stranske/Workflows::]

Fallback trigger condition:
The fallback is only invoked when the local action is unavailable (when steps.api_client_base.outputs.available != 'true' or steps.api_client_head.outputs.available != 'true'). This guards against potential breaking changes by providing a fallback mechanism. [::stranske/Workflows::]

Cross-repository impact assessment:
Since the commits d68de19 and c2537cc do not exist in the current repository (verified via git commands), they reference external commit hashes. This is consistent with Mend Renovate's automated dependency update pattern. The actual changes between these commits cannot be determined without access to those specific commits on the remote or branch.

🔇 Additional comments (1)

.github/workflows/agents-guard.yml (1)

114-114: LGTM!

Also applies to: 183-183

---

📝 Walkthrough

Walkthrough

Two lines in .github/workflows/agents-guard.yml are updated: the pinned commit hash for stranske/Workflows/.github/actions/setup-api-client is changed from d68de190... to c2537cc... in both the pull_request_target and pull_request fallback steps.

Changes

Action Hash Bump

Layer / File(s)	Summary
Pinned hash update for both workflow triggers .github/workflows/agents-guard.yml	Updates the uses: commit hash for setup-api-client (Workflows fallback) in both the pull_request_target step (line 114) and the pull_request step (line 183).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: updating the stranske/workflows dependency digest to a new commit hash.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/stranske-workflows-digest

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[agents-workflows-bot]

Automated Status Summary

Head SHA: fbfa5c4
Latest Runs: ⏳ pending — Gate
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined