chore(deps): update stranske/workflows digest to a0bf67e - #391
Closed
renovate[bot] wants to merge 1 commit into
Closed
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughTwo lines in agents-guard workflow SHA bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
Workflow state fingerprint for Agents Gate Followups. Do not edit. |
Contributor
|
Workflow state fingerprint for Keepalive Loop Reporter. Do not edit. |
Contributor
Workflow source neededPR #391 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: The SHA update for the setup-api-client action should not be patched
only in the local agents-guard workflow mirror; update the canonical
agents-guard.yml in stranske/Workflows first, then let the mirrored copy and any
drift metadata follow. Adjust the reference in the setup-api-client step so the
upstream template remains the source of truth, and keep the local
agents-guard.yml aligned with the canonical version to avoid template drift.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 74fb4b57-80d1-47f6-ba51-d586a5f1fead
📒 Files selected for processing (1)
.github/workflows/agents-guard.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Workflows(auto-detected) → reviewed against open PR#2546renovate/stranske-workflows-digestinstead of the default branchstranske/Template(auto-detected) → reviewed against open PR#881renovate/stranske-workflows-digestinstead of the default branch
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Update keepalive summary
⚠️ CI failures not shown inline (4)
GitHub Actions: Claude Code Review (Opt-in) / Resolve review target: chore(deps): update stranske/workflows digest to a0bf67e
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1m# Use dedicated scripts dir, create if needed�[0m
�[36;1mINSTALL_DIR=""�[0m
�[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
�[36;1m INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
�[36;1mfi�[0m
�[36;1mmkdir -p "$INSTALL_DIR"�[0m
�[36;1m�[0m
�[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
�[36;1mcd "$INSTALL_DIR"�[0m
�[36;1m�[0m
�[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
�[36;1m�[0m
�[36;1mcleanup_vendor_aliases() ***�[0m
�[36;1m if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m local cleanup_dir="$INSTALL_DIR"�[0m
�[36;1m if [ -z "$cleanup_dir" ]; then�[0m
�[36;1m echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
�[36;1m echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
�[36;1m if [ -z "$vendored_alias" ]; then�[0m
�[36;1m continue�[0m
�[36;1m fi�[0m
�[36;1m rm -rf -- "$vendored_alias" || true�[0m
�[36;1m local parent_dir�[0m
�[36;1m parent_dir=$(dirname "$vendored_alias")�[0m
�[36;1m # Remove empty parent directories that may have been created for scoped packages�[0m
�[36;1m while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
�[36;1m rmdir -- "$parent_dir" 2>/dev/null || break�[0m
�[36;1m parent_dir=$(dirname "$parent_dir")�[0m
�[36;1m done�[0m
�[36;1m done�[0m
�[36;1m�[0m
�[36;1m popd >/dev/null 2>&1 || true�[0m
�[36;1m***�[0m
�[36;1m�[0m
�[36;1mtrap cleanup_vendor_aliases EXIT�[0m
�[36;1m�[0m
�[36;1mcreate_vendor_aliases() ***�[0m
�[36;1m if [ ! -f "package.json" ];...
GitHub Actions: Agents Verifier / check: chore(deps): update stranske/workflows digest to a0bf67e
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1m# Use dedicated scripts dir, create if needed�[0m
�[36;1mINSTALL_DIR=""�[0m
�[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
�[36;1m INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
�[36;1mfi�[0m
�[36;1mmkdir -p "$INSTALL_DIR"�[0m
�[36;1m�[0m
�[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
�[36;1mcd "$INSTALL_DIR"�[0m
�[36;1m�[0m
�[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
�[36;1m�[0m
�[36;1mcleanup_vendor_aliases() ***�[0m
�[36;1m if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m local cleanup_dir="$INSTALL_DIR"�[0m
�[36;1m if [ -z "$cleanup_dir" ]; then�[0m
�[36;1m echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
�[36;1m echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
�[36;1m if [ -z "$vendored_alias" ]; then�[0m
�[36;1m continue�[0m
�[36;1m fi�[0m
�[36;1m rm -rf -- "$vendored_alias" || true�[0m
�[36;1m local parent_dir�[0m
�[36;1m parent_dir=$(dirname "$vendored_alias")�[0m
�[36;1m # Remove empty parent directories that may have been created for scoped packages�[0m
�[36;1m while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
�[36;1m rmdir -- "$parent_dir" 2>/dev/null || break�[0m
�[36;1m parent_dir=$(dirname "$parent_dir")�[0m
�[36;1m done�[0m
�[36;1m done�[0m
�[36;1m�[0m
�[36;1m popd >/dev/null 2>&1 || true�[0m
�[36;1m***�[0m
�[36;1m�[0m
�[36;1mtrap cleanup_vendor_aliases EXIT�[0m
�[36;1m�[0m
�[36;1mcreate_vendor_aliases() ***�[0m
�[36;1m if [ ! -f "package.json" ];...
GitHub Actions: Agents Verifier / 2_check.txt: chore(deps): update stranske/workflows digest to a0bf67e
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1m# Use dedicated scripts dir, create if needed�[0m
�[36;1mINSTALL_DIR=""�[0m
�[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
�[36;1m INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
�[36;1mfi�[0m
�[36;1mmkdir -p "$INSTALL_DIR"�[0m
�[36;1m�[0m
�[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
�[36;1mcd "$INSTALL_DIR"�[0m
�[36;1m�[0m
�[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
�[36;1m�[0m
�[36;1mcleanup_vendor_aliases() ***�[0m
�[36;1m if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m local cleanup_dir="$INSTALL_DIR"�[0m
�[36;1m if [ -z "$cleanup_dir" ]; then�[0m
�[36;1m echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
�[36;1m echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
�[36;1m if [ -z "$vendored_alias" ]; then�[0m
�[36;1m continue�[0m
�[36;1m fi�[0m
�[36;1m rm -rf -- "$vendored_alias" || true�[0m
�[36;1m local parent_dir�[0m
�[36;1m parent_dir=$(dirname "$vendored_alias")�[0m
�[36;1m # Remove empty parent directories that may have been created for scoped packages�[0m
�[36;1m while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
�[36;1m rmdir -- "$parent_dir" 2>/dev/null || break�[0m
�[36;1m parent_dir=$(dirname "$parent_dir")�[0m
�[36;1m done�[0m
�[36;1m done�[0m
�[36;1m�[0m
�[36;1m popd >/dev/null 2>&1 || true�[0m
�[36;1m***�[0m
�[36;1m�[0m
�[36;1mtrap cleanup_vendor_aliases EXIT�[0m
�[36;1m�[0m
�[36;1mcreate_vendor_aliases() ***�[0m
�[36;1m if [ ! -f "package.json" ];...
GitHub Actions: Claude Code Review (Opt-in) / 5_Resolve review target.txt: chore(deps): update stranske/workflows digest to a0bf67e
Conclusion: failure
##[group]Run set -euo pipefail
�[36;1mset -euo pipefail�[0m
�[36;1m�[0m
�[36;1m# Use dedicated scripts dir, create if needed�[0m
�[36;1mINSTALL_DIR=""�[0m
�[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
�[36;1m INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
�[36;1mfi�[0m
�[36;1mmkdir -p "$INSTALL_DIR"�[0m
�[36;1m�[0m
�[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
�[36;1mcd "$INSTALL_DIR"�[0m
�[36;1m�[0m
�[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
�[36;1m�[0m
�[36;1mcleanup_vendor_aliases() ***�[0m
�[36;1m if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m local cleanup_dir="$INSTALL_DIR"�[0m
�[36;1m if [ -z "$cleanup_dir" ]; then�[0m
�[36;1m echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
�[36;1m echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
�[36;1m return 0�[0m
�[36;1m fi�[0m
�[36;1m�[0m
�[36;1m for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
�[36;1m if [ -z "$vendored_alias" ]; then�[0m
�[36;1m continue�[0m
�[36;1m fi�[0m
�[36;1m rm -rf -- "$vendored_alias" || true�[0m
�[36;1m local parent_dir�[0m
�[36;1m parent_dir=$(dirname "$vendored_alias")�[0m
�[36;1m # Remove empty parent directories that may have been created for scoped packages�[0m
�[36;1m while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
�[36;1m rmdir -- "$parent_dir" 2>/dev/null || break�[0m
�[36;1m parent_dir=$(dirname "$parent_dir")�[0m
�[36;1m done�[0m
�[36;1m done�[0m
�[36;1m�[0m
�[36;1m popd >/dev/null 2>&1 || true�[0m
�[36;1m***�[0m
�[36;1m�[0m
�[36;1mtrap cleanup_vendor_aliases EXIT�[0m
�[36;1m�[0m
�[36;1mcreate_vendor_aliases() ***�[0m
�[36;1m if [ ! -f "package.json" ];...
🧰 Additional context used
📓 Path-based instructions (4)
{pyproject.toml,.github/workflows/*.{yml,yaml}}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Ensure coverage threshold values in pyproject.toml '[tool.coverage.report] fail_under' match the 'coverage-min' settings in workflow files; the lower threshold value will be the effective limit
Files:
.github/workflows/agents-guard.yml
.github/workflows/**/*.{yml,yaml}
📄 CodeRabbit inference engine (CLAUDE.md)
Reference reusable workflows with
@mainto match first-party consumer defaults, unless intentionally pinning to an exact commit SHA for a controlled reason
Files:
.github/workflows/agents-guard.yml
.github/workflows/agents-*.{yml,yaml}
📄 CodeRabbit inference engine (CLAUDE.md)
Edit
agents-*.ymlfiles instranske/Workflowsinstead of locally
Files:
.github/workflows/agents-guard.yml
**/.github/workflows/*.yml
📄 CodeRabbit inference engine (AGENTS.md)
Reference reusable workflows from stranske/Workflows with
@mainunless intentionally pinning to an exact commit SHA for a controlled reason
Files:
.github/workflows/agents-guard.yml
🔀 Multi-repo context stranske/Workflows, stranske/Template
Linked repositories findings
stranske/Workflows (ref: PR branch)
config/template-drift-allowlist.txt:87-91still documents theagents-guard.ymldivergence as usingsetup-api-clientfallback pins that point at the olda525e6edigest. That rationale is now stale relative to this PR’s digest bump toa0bf67e, so the allowlist note likely needs a refresh. [::stranske/Workflows::]
stranske/Template (ref: PR branch)
- I found the mirrored
agents-guard.ymlandsetup-api-clientassets, plus docs sayingagents:allow-changeapplies to dependency-onlyuses:updates, but no direct reference to either digest SHA in the branch output. No additional breaking consumer was identified from this repo scan. [::stranske/Template::]
| steps.eligibility.outputs.should-run == 'true' && | ||
| steps.api_client_base.outputs.available != 'true' | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@a525e6e3e2431d302073de65723c6e022f4b02fa" # v1 | ||
| uses: "stranske/Workflows/.github/actions/setup-api-client@a0bf67ebf03ca6767607b6da335fd21a88ebf787" # v1 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift
Update the canonical agents-guard.yml in stranske/Workflows instead of patching the local mirror.
This file matches the repo rule for agents-*.yml, so the SHA bump should land in stranske/Workflows first and then flow down here. Keeping the change local increases template drift; the linked upstream repo still documents the old fallback digest in config/template-drift-allowlist.txt:87-91, so this PR would immediately leave the mirror and its drift metadata out of sync. As per coding guidelines, "Edit agents-*.yml files in stranske/Workflows instead of locally".
Also applies to: 183-183
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-guard.yml at line 114, The SHA update for the
setup-api-client action should not be patched only in the local agents-guard
workflow mirror; update the canonical agents-guard.yml in stranske/Workflows
first, then let the mirrored copy and any drift metadata follow. Adjust the
reference in the setup-api-client step so the upstream template remains the
source of truth, and keep the local agents-guard.yml aligned with the canonical
version to avoid template drift.
Sources: Coding guidelines, Linked repositories
Owner
|
Closing as superseded by merged Workflows source updates and Maint 68 sync propagation for stranske/workflows digest changes. |
Contributor
Author
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
a525e6e→a0bf67eConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.