chore(deps): update stranske/workflows digest to a0bf67e by renovate[bot] · Pull Request #881 · stranske/Template

renovate · 2026-06-27T16:35:20Z

This PR contains the following updates:

Package	Type	Update	Change
stranske/Workflows (changelog)	action	digest	`a525e6e` → `a0bf67e`

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-06-27T16:35:31Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a1113661-e289-4b78-a4a0-f1f333fefc81

📥 Commits

Reviewing files that changed from the base of the PR and between 6805e98 and 91e5f45.

📒 Files selected for processing (1)

.github/workflows/agents-guard.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

stranske/Workflows (auto-detected) → reviewed against open PR #2546 renovate/stranske-workflows-digest instead of the default branch

📜 Recent review details

⚠️ CI failures not shown inline (8)

GitHub Actions: Gate / summary: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Use dedicated scripts dir, create if needed�[0m
 �[36;1mINSTALL_DIR=""�[0m
 �[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
 �[36;1m  INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
 �[36;1mfi�[0m
 �[36;1mmkdir -p "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
 �[36;1mcd "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
 �[36;1m�[0m
 �[36;1mcleanup_vendor_aliases() ***�[0m
 �[36;1m  if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  local cleanup_dir="$INSTALL_DIR"�[0m
 �[36;1m  if [ -z "$cleanup_dir" ]; then�[0m
 �[36;1m    echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
 �[36;1m    echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
 �[36;1m    if [ -z "$vendored_alias" ]; then�[0m
 �[36;1m      continue�[0m
 �[36;1m    fi�[0m
 �[36;1m    rm -rf -- "$vendored_alias" || true�[0m
 �[36;1m    local parent_dir�[0m
 �[36;1m    parent_dir=$(dirname "$vendored_alias")�[0m
 �[36;1m    # Remove empty parent directories that may have been created for scoped packages�[0m
 �[36;1m    while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
 �[36;1m      rmdir -- "$parent_dir" 2>/dev/null || break�[0m
 �[36;1m      parent_dir=$(dirname "$parent_dir")�[0m
 �[36;1m    done�[0m
 �[36;1m  done�[0m
 �[36;1m�[0m
 �[36;1m  popd >/dev/null 2>&1 || true�[0m
 �[36;1m***�[0m
 �[36;1m�[0m
 �[36;1mtrap cleanup_vendor_aliases EXIT�[0m
 �[36;1m�[0m
 �[36;1mcreate_vendor_aliases() ***�[0m
 �[36;1m  if [ ! -f "package.json" ];...

GitHub Actions: Gate / 0_summary.txt: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Use dedicated scripts dir, create if needed�[0m
 �[36;1mINSTALL_DIR=""�[0m
 �[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
 �[36;1m  INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
 �[36;1mfi�[0m
 �[36;1mmkdir -p "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
 �[36;1mcd "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
 �[36;1m�[0m
 �[36;1mcleanup_vendor_aliases() ***�[0m
 �[36;1m  if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  local cleanup_dir="$INSTALL_DIR"�[0m
 �[36;1m  if [ -z "$cleanup_dir" ]; then�[0m
 �[36;1m    echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
 �[36;1m    echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
 �[36;1m    if [ -z "$vendored_alias" ]; then�[0m
 �[36;1m      continue�[0m
 �[36;1m    fi�[0m
 �[36;1m    rm -rf -- "$vendored_alias" || true�[0m
 �[36;1m    local parent_dir�[0m
 �[36;1m    parent_dir=$(dirname "$vendored_alias")�[0m
 �[36;1m    # Remove empty parent directories that may have been created for scoped packages�[0m
 �[36;1m    while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
 �[36;1m      rmdir -- "$parent_dir" 2>/dev/null || break�[0m
 �[36;1m      parent_dir=$(dirname "$parent_dir")�[0m
 �[36;1m    done�[0m
 �[36;1m  done�[0m
 �[36;1m�[0m
 �[36;1m  popd >/dev/null 2>&1 || true�[0m
 �[36;1m***�[0m
 �[36;1m�[0m
 �[36;1mtrap cleanup_vendor_aliases EXIT�[0m
 �[36;1m�[0m
 �[36;1mcreate_vendor_aliases() ***�[0m
 �[36;1m  if [ ! -f "package.json" ];...

GitHub Actions: Agents Gate Followups / 2_Record autofix metrics.txt: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
 with:
   github-***REDACTED***
   script: const fs = require('fs');
const retryPath = './.github/scripts/github-api-with-retry.js';
const { createTokenAwareRetry } = fs.existsSync(retryPath)
  ? require(retryPath)
  : { createTokenAwareRetry: async () => ({
      withRetry: (fn) => fn(github),
      paginateWithRetry: (method, params) => github.paginate(method, params)
    }) };
const { withRetry, paginateWithRetry } = await createTokenAwareRetry({ github, core });
const prNumber = Number('0') || 0;
const attemptNumber = Number('0') || 0;
const attemptLimit = Number('0') || 0;
const headShaBefore = '';
const gateConclusionBefore =
  '' ||
  (context.payload.workflow_run?.conclusion || '');
const gateRunId =
  '' ||
  String(context.payload.workflow_run?.id || '');
const triggerReason = 'unknown';
const triggerJob = '';
const triggerStep = '';
const stopReason = '';
const codexAutofixResult = 'skipped';
const claudeAutofixResult = 'skipped';
const autofixResult =
  codexAutofixResult && codexAutofixResult !== 'skipped'
    ? codexAutofixResult
    : claudeAutofixResult;
const { owner, repo } = context.repo;
let fixApplied = false;
let headShaAfter = headShaBefore;
let gateResultAfter = gateConclusionBefore || 'unknown';
if (prNumber) {
  try {
    const { data: pr } = await withRetry((client) => client.rest.pulls.get({
      owner,
      repo,
      pull_number: prNumber,
    }));
    headShaAfter = pr.head?.sha || headShaAfter;
      fixApplied = Boolean(
        headShaBefore && headShaAfter && headShaBefore !== headShaAfter
      );
    // Remove autofix:escalated label when fixes are applied
    // This allows re-escalation to the agent if Gate fails again
    if (fixApplied) {
      const prLabels = pr.labels?.map(l => l.name) || [];
      if (prLabels.includes('autofix:escalated')) {
        try {
          await withRetry((client) => client.rest.issues.removeLabel({
            own...

GitHub Actions: Agents Verifier / check: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Use dedicated scripts dir, create if needed�[0m
 �[36;1mINSTALL_DIR=""�[0m
 �[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
 �[36;1m  INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
 �[36;1mfi�[0m
 �[36;1mmkdir -p "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
 �[36;1mcd "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
 �[36;1m�[0m
 �[36;1mcleanup_vendor_aliases() ***�[0m
 �[36;1m  if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  local cleanup_dir="$INSTALL_DIR"�[0m
 �[36;1m  if [ -z "$cleanup_dir" ]; then�[0m
 �[36;1m    echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
 �[36;1m    echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
 �[36;1m    if [ -z "$vendored_alias" ]; then�[0m
 �[36;1m      continue�[0m
 �[36;1m    fi�[0m
 �[36;1m    rm -rf -- "$vendored_alias" || true�[0m
 �[36;1m    local parent_dir�[0m
 �[36;1m    parent_dir=$(dirname "$vendored_alias")�[0m
 �[36;1m    # Remove empty parent directories that may have been created for scoped packages�[0m
 �[36;1m    while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
 �[36;1m      rmdir -- "$parent_dir" 2>/dev/null || break�[0m
 �[36;1m      parent_dir=$(dirname "$parent_dir")�[0m
 �[36;1m    done�[0m
 �[36;1m  done�[0m
 �[36;1m�[0m
 �[36;1m  popd >/dev/null 2>&1 || true�[0m
 �[36;1m***�[0m
 �[36;1m�[0m
 �[36;1mtrap cleanup_vendor_aliases EXIT�[0m
 �[36;1m�[0m
 �[36;1mcreate_vendor_aliases() ***�[0m
 �[36;1m  if [ ! -f "package.json" ];...

GitHub Actions: Agents Gate Followups / Record autofix metrics: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
 with:
   github-***REDACTED***
   script: const fs = require('fs');
const retryPath = './.github/scripts/github-api-with-retry.js';
const { createTokenAwareRetry } = fs.existsSync(retryPath)
  ? require(retryPath)
  : { createTokenAwareRetry: async () => ({
      withRetry: (fn) => fn(github),
      paginateWithRetry: (method, params) => github.paginate(method, params)
    }) };
const { withRetry, paginateWithRetry } = await createTokenAwareRetry({ github, core });
const prNumber = Number('0') || 0;
const attemptNumber = Number('0') || 0;
const attemptLimit = Number('0') || 0;
const headShaBefore = '';
const gateConclusionBefore =
  '' ||
  (context.payload.workflow_run?.conclusion || '');
const gateRunId =
  '' ||
  String(context.payload.workflow_run?.id || '');
const triggerReason = 'unknown';
const triggerJob = '';
const triggerStep = '';
const stopReason = '';
const codexAutofixResult = 'skipped';
const claudeAutofixResult = 'skipped';
const autofixResult =
  codexAutofixResult && codexAutofixResult !== 'skipped'
    ? codexAutofixResult
    : claudeAutofixResult;
const { owner, repo } = context.repo;
let fixApplied = false;
let headShaAfter = headShaBefore;
let gateResultAfter = gateConclusionBefore || 'unknown';
if (prNumber) {
  try {
    const { data: pr } = await withRetry((client) => client.rest.pulls.get({
      owner,
      repo,
      pull_number: prNumber,
    }));
    headShaAfter = pr.head?.sha || headShaAfter;
      fixApplied = Boolean(
        headShaBefore && headShaAfter && headShaBefore !== headShaAfter
      );
    // Remove autofix:escalated label when fixes are applied
    // This allows re-escalation to the agent if Gate fails again
    if (fixApplied) {
      const prLabels = pr.labels?.map(l => l.name) || [];
      if (prLabels.includes('autofix:escalated')) {
        try {
          await withRetry((client) => client.rest.issues.removeLabel({
            own...

GitHub Actions: Agents Verifier / 2_check.txt: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Use dedicated scripts dir, create if needed�[0m
 �[36;1mINSTALL_DIR=""�[0m
 �[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
 �[36;1m  INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
 �[36;1mfi�[0m
 �[36;1mmkdir -p "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
 �[36;1mcd "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
 �[36;1m�[0m
 �[36;1mcleanup_vendor_aliases() ***�[0m
 �[36;1m  if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  local cleanup_dir="$INSTALL_DIR"�[0m
 �[36;1m  if [ -z "$cleanup_dir" ]; then�[0m
 �[36;1m    echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
 �[36;1m    echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
 �[36;1m    if [ -z "$vendored_alias" ]; then�[0m
 �[36;1m      continue�[0m
 �[36;1m    fi�[0m
 �[36;1m    rm -rf -- "$vendored_alias" || true�[0m
 �[36;1m    local parent_dir�[0m
 �[36;1m    parent_dir=$(dirname "$vendored_alias")�[0m
 �[36;1m    # Remove empty parent directories that may have been created for scoped packages�[0m
 �[36;1m    while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
 �[36;1m      rmdir -- "$parent_dir" 2>/dev/null || break�[0m
 �[36;1m      parent_dir=$(dirname "$parent_dir")�[0m
 �[36;1m    done�[0m
 �[36;1m  done�[0m
 �[36;1m�[0m
 �[36;1m  popd >/dev/null 2>&1 || true�[0m
 �[36;1m***�[0m
 �[36;1m�[0m
 �[36;1mtrap cleanup_vendor_aliases EXIT�[0m
 �[36;1m�[0m
 �[36;1mcreate_vendor_aliases() ***�[0m
 �[36;1m  if [ ! -f "package.json" ];...

GitHub Actions: Claude Code Review (Opt-in) / Resolve review target: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Use dedicated scripts dir, create if needed�[0m
 �[36;1mINSTALL_DIR=""�[0m
 �[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
 �[36;1m  INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
 �[36;1mfi�[0m
 �[36;1mmkdir -p "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
 �[36;1mcd "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
 �[36;1m�[0m
 �[36;1mcleanup_vendor_aliases() ***�[0m
 �[36;1m  if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  local cleanup_dir="$INSTALL_DIR"�[0m
 �[36;1m  if [ -z "$cleanup_dir" ]; then�[0m
 �[36;1m    echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
 �[36;1m    echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
 �[36;1m    if [ -z "$vendored_alias" ]; then�[0m
 �[36;1m      continue�[0m
 �[36;1m    fi�[0m
 �[36;1m    rm -rf -- "$vendored_alias" || true�[0m
 �[36;1m    local parent_dir�[0m
 �[36;1m    parent_dir=$(dirname "$vendored_alias")�[0m
 �[36;1m    # Remove empty parent directories that may have been created for scoped packages�[0m
 �[36;1m    while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
 �[36;1m      rmdir -- "$parent_dir" 2>/dev/null || break�[0m
 �[36;1m      parent_dir=$(dirname "$parent_dir")�[0m
 �[36;1m    done�[0m
 �[36;1m  done�[0m
 �[36;1m�[0m
 �[36;1m  popd >/dev/null 2>&1 || true�[0m
 �[36;1m***�[0m
 �[36;1m�[0m
 �[36;1mtrap cleanup_vendor_aliases EXIT�[0m
 �[36;1m�[0m
 �[36;1mcreate_vendor_aliases() ***�[0m
 �[36;1m  if [ ! -f "package.json" ];...

GitHub Actions: Claude Code Review (Opt-in) / 5_Resolve review target.txt: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Use dedicated scripts dir, create if needed�[0m
 �[36;1mINSTALL_DIR=""�[0m
 �[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
 �[36;1m  INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
 �[36;1mfi�[0m
 �[36;1mmkdir -p "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
 �[36;1mcd "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
 �[36;1m�[0m
 �[36;1mcleanup_vendor_aliases() ***�[0m
 �[36;1m  if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  local cleanup_dir="$INSTALL_DIR"�[0m
 �[36;1m  if [ -z "$cleanup_dir" ]; then�[0m
 �[36;1m    echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
 �[36;1m    echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
 �[36;1m    if [ -z "$vendored_alias" ]; then�[0m
 �[36;1m      continue�[0m
 �[36;1m    fi�[0m
 �[36;1m    rm -rf -- "$vendored_alias" || true�[0m
 �[36;1m    local parent_dir�[0m
 �[36;1m    parent_dir=$(dirname "$vendored_alias")�[0m
 �[36;1m    # Remove empty parent directories that may have been created for scoped packages�[0m
 �[36;1m    while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
 �[36;1m      rmdir -- "$parent_dir" 2>/dev/null || break�[0m
 �[36;1m      parent_dir=$(dirname "$parent_dir")�[0m
 �[36;1m    done�[0m
 �[36;1m  done�[0m
 �[36;1m�[0m
 �[36;1m  popd >/dev/null 2>&1 || true�[0m
 �[36;1m***�[0m
 �[36;1m�[0m
 �[36;1mtrap cleanup_vendor_aliases EXIT�[0m
 �[36;1m�[0m
 �[36;1mcreate_vendor_aliases() ***�[0m
 �[36;1m  if [ ! -f "package.json" ];...

🧰 Additional context used

📓 Path-based instructions (4)

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.github/workflows/**/*.{yml,yaml}: Ensure coverage threshold settings in GitHub Actions workflow files for coverage-min match the [tool.coverage.report] fail_under setting in pyproject.toml, as the lower value will be the effective threshold
For startup_failure in GitHub Actions workflows with zero jobs, check for invalid YAML syntax, top-level permissions: blocks in workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

.github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

.github/workflows/agents-guard.yml

.github/workflows/**/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

.github/workflows/agents-guard.yml

.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (AGENTS.md)

Agent workflows (agents-*.yml), autofix.yml, synced prompts in .github/codex/, and synced scripts/docs should be fixed in stranske/Workflows, not in the consumer repository

Files:

.github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Workflows

Linked repositories findings

stranske/Workflows (inspected `refs/pull/2546/head`)

[::stranske/Workflows::] .github/actions/setup-api-client/action.yml — the action’s public contract is unchanged: same inputs (secrets, github_token, PAT/app creds, install_dir, skip_deps, verbose) and same outputs (token_count, available_tokens, setup_contract).
[::stranske/Workflows::] .github/workflows/agents-guard.yml — the only consumer change visible in this ref is the fallback uses: "stranske/Workflows/.github/actions/setup-api-client@a0bf67ebf03ca6767607b6da335fd21a88ebf787" in both pull_request_target and pull_request; logic and wiring around it are unchanged.

🔇 Additional comments (1)

.github/workflows/agents-guard.yml (1)

114-114: LGTM!

Also applies to: 183-183

📝 Walkthrough

Walkthrough

Updates the pinned commit SHA for stranske/Workflows/.github/actions/setup-api-client in the agents-guard.yml workflow, applying the same new SHA to both the pull_request_target and pull_request fallback setup steps.

agents-guard.yml SHA pin update

Layer / File(s)	Summary
Update pinned SHA in both workflow triggers `.github/workflows/agents-guard.yml`	Replaces the previous commit SHA with a new one for the `setup-api-client` fallback action in both the `pull_request_target` (line 114) and `pull_request` (line 183) steps.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

stranske/Template#834: Modifies the same workflow file updating the same setup-api-client pinned SHA in both fallback branches.
stranske/Template#874: Same file and same action pin updated for both pull_request_target and pull_request steps.
stranske/Template#849: Identical change pattern — updates pinned SHA for setup-api-client in both fallback steps of agents-guard.yml.

Suggested reviewers

stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the digest update to the stranske/Workflows GitHub Action.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/stranske-workflows-digest

_{Comment @coderabbitai help to get the list of available commands.}

agents-workflows-bot · 2026-06-27T16:35:46Z

Automated Status Summary

Head SHA: 98f0b4b
Latest Runs: ⏳ pending — Gate
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

Keepalive checklist

Scope

No scope information available

Tasks

No tasks defined

Acceptance criteria

No acceptance criteria defined

stranske · 2026-06-30T05:32:51Z

Closing as superseded by merged Workflows source updates and Maint 68 sync propagation for stranske/workflows digest changes.

renovate · 2026-06-30T05:33:30Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the stranske/Workflows a0bf67e update again.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

chore(deps): update stranske/workflows digest to a0bf67e

91e5f45

renovate Bot added the dependencies label Jun 27, 2026

renovate Bot requested a review from stranske as a code owner June 27, 2026 16:35

renovate Bot had a problem deploying to agent-standard June 27, 2026 16:35 Failure

renovate Bot temporarily deployed to agent-high-privilege June 27, 2026 16:36 Inactive

stranske closed this Jun 30, 2026

stranske deleted the renovate/stranske-workflows-digest branch June 30, 2026 05:32

Navigation Menu

chore(deps): update stranske/workflows digest to a0bf67e - #881

chore(deps): update stranske/workflows digest to a0bf67e#881
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/stranske-workflows-digest

renovate Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jun 27, 2026 •

edited

Loading

Linked repositories findings

stranske/Workflows (inspected `refs/pull/2546/head`)

Walkthrough

Estimated code review effort

Possibly related PRs

Suggested reviewers

Uh oh!

agents-workflows-bot Bot commented Jun 27, 2026 •

edited by stranske-keepalive Bot

Loading

Uh oh!

stranske commented Jun 30, 2026

Uh oh!

renovate Bot commented Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Configuration

Uh oh!

coderabbitai Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Linked repositories findings

stranske/Workflows (inspected refs/pull/2546/head)

Walkthrough

Estimated code review effort

Possibly related PRs

Suggested reviewers

Uh oh!

agents-workflows-bot Bot commented Jun 27, 2026 • edited by stranske-keepalive Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Automated Status Summary

Coverage Overview

Keepalive checklist

Scope

Tasks

Acceptance criteria

Uh oh!

stranske commented Jun 30, 2026

Uh oh!

renovate Bot commented Jun 30, 2026

Renovate Ignore Notification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jun 27, 2026 •

edited

Loading

coderabbitai Bot commented Jun 27, 2026 •

edited

Loading

stranske/Workflows (inspected `refs/pull/2546/head`)

agents-workflows-bot Bot commented Jun 27, 2026 •

edited by stranske-keepalive Bot

Loading