Skip to content

chore(deps): update stranske/workflows digest to a0bf67e - #1491

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/stranske-workflows-digest
Closed

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/stranske-workflows-digest

Conversation

@renovate

@renovate renovate Bot commented Jun 27, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
stranske/Workflows (changelog) action digest a525e6ea0bf67e

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from stranske as a code owner June 27, 2026 16:41
@renovate
renovate Bot had a problem deploying to agent-standard June 27, 2026 16:41 Failure
@netlify

netlify Bot commented Jun 27, 2026

Copy link
Copy Markdown

Deploy Preview for stranske-trip-planner canceled.

Name Link
🔨 Latest commit 2449ce8
🔍 Latest deploy log https://app.netlify.com/projects/stranske-trip-planner/deploys/6a3ffd345f06ea00085530bd

@coderabbitai

coderabbitai Bot commented Jun 27, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

Updates the pinned commit SHA for stranske/Workflows/.github/actions/setup-api-client in the agents-guard.yml workflow, changing it from a525e6e3e2431d302073de65723c6e022f4b02fa to a0bf67ebf03ca6767607b6da335fd21a88ebf787 in both the pull_request_target and pull_request fallback steps.

Changes

Action SHA Bump

Layer / File(s) Summary
Pinned SHA update
.github/workflows/agents-guard.yml
Updates the setup-api-client action commit SHA in both the pull_request_target and pull_request "Workflows fallback" steps.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

  • stranske/trip-planner#1430: Updates the same agents-guard.yml fallback setup-api-client pinned SHA with no other logic changes.
  • stranske/trip-planner#1439: Modifies the same agents-guard.yml "Workflows fallback" step by repinning the same action SHA for both event triggers.
  • stranske/trip-planner#1467: Repins the same setup-api-client action in the same fallback steps of agents-guard.yml.

Suggested labels

automated

Suggested reviewers

  • stranske
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the digest update to stranske/Workflows and matches the main change in the PR.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/stranske-workflows-digest

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: The SHA bump in agents-guard.yml (the setup-api-client action
reference) should not be edited in this consumer repo because this is a synced
agents-*.yml workflow. Revert any local change here and make the update in
stranske/Workflows instead, then let the normal sync bring it back into this
repo; keep the consumer copy unchanged to avoid source-of-truth drift.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e7b115e7-b665-4f28-88fd-2de15e54366d

📥 Commits

Reviewing files that changed from the base of the PR and between 5ba0668 and 2449ce8.

📒 Files selected for processing (1)
  • .github/workflows/agents-guard.yml
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

📜 Review details
⏰ Context from checks skipped due to timeout. (3)
  • GitHub Check: Cross-Repo Smoke / cross-repo-full-product
  • GitHub Check: Runtime CI
  • GitHub Check: cross-repo-full-product
⚠️ CI failures not shown inline (7)

GitHub Actions: Agents Verifier / check: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Use dedicated scripts dir, create if needed�[0m
 �[36;1mINSTALL_DIR=""�[0m
 �[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
 �[36;1m  INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
 �[36;1mfi�[0m
 �[36;1mmkdir -p "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
 �[36;1mcd "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
 �[36;1m�[0m
 �[36;1mcleanup_vendor_aliases() ***�[0m
 �[36;1m  if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  local cleanup_dir="$INSTALL_DIR"�[0m
 �[36;1m  if [ -z "$cleanup_dir" ]; then�[0m
 �[36;1m    echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
 �[36;1m    echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
 �[36;1m    if [ -z "$vendored_alias" ]; then�[0m
 �[36;1m      continue�[0m
 �[36;1m    fi�[0m
 �[36;1m    rm -rf -- "$vendored_alias" || true�[0m
 �[36;1m    local parent_dir�[0m
 �[36;1m    parent_dir=$(dirname "$vendored_alias")�[0m
 �[36;1m    # Remove empty parent directories that may have been created for scoped packages�[0m
 �[36;1m    while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
 �[36;1m      rmdir -- "$parent_dir" 2>/dev/null || break�[0m
 �[36;1m      parent_dir=$(dirname "$parent_dir")�[0m
 �[36;1m    done�[0m
 �[36;1m  done�[0m
 �[36;1m�[0m
 �[36;1m  popd >/dev/null 2>&1 || true�[0m
 �[36;1m***�[0m
 �[36;1m�[0m
 �[36;1mtrap cleanup_vendor_aliases EXIT�[0m
 �[36;1m�[0m
 �[36;1mcreate_vendor_aliases() ***�[0m
 �[36;1m  if [ ! -f "package.json" ];...

GitHub Actions: Agents Verifier / 2_check.txt: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Use dedicated scripts dir, create if needed�[0m
 �[36;1mINSTALL_DIR=""�[0m
 �[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
 �[36;1m  INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
 �[36;1mfi�[0m
 �[36;1mmkdir -p "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
 �[36;1mcd "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
 �[36;1m�[0m
 �[36;1mcleanup_vendor_aliases() ***�[0m
 �[36;1m  if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  local cleanup_dir="$INSTALL_DIR"�[0m
 �[36;1m  if [ -z "$cleanup_dir" ]; then�[0m
 �[36;1m    echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
 �[36;1m    echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
 �[36;1m    if [ -z "$vendored_alias" ]; then�[0m
 �[36;1m      continue�[0m
 �[36;1m    fi�[0m
 �[36;1m    rm -rf -- "$vendored_alias" || true�[0m
 �[36;1m    local parent_dir�[0m
 �[36;1m    parent_dir=$(dirname "$vendored_alias")�[0m
 �[36;1m    # Remove empty parent directories that may have been created for scoped packages�[0m
 �[36;1m    while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
 �[36;1m      rmdir -- "$parent_dir" 2>/dev/null || break�[0m
 �[36;1m      parent_dir=$(dirname "$parent_dir")�[0m
 �[36;1m    done�[0m
 �[36;1m  done�[0m
 �[36;1m�[0m
 �[36;1m  popd >/dev/null 2>&1 || true�[0m
 �[36;1m***�[0m
 �[36;1m�[0m
 �[36;1mtrap cleanup_vendor_aliases EXIT�[0m
 �[36;1m�[0m
 �[36;1mcreate_vendor_aliases() ***�[0m
 �[36;1m  if [ ! -f "package.json" ];...

GitHub Actions: Agents Gate Followups / 2_Record autofix metrics.txt: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
 with:
   github-***REDACTED***
   script: const fs = require('fs');
const retryPath = './.github/scripts/github-api-with-retry.js';
const { createTokenAwareRetry } = fs.existsSync(retryPath)
  ? require(retryPath)
  : { createTokenAwareRetry: async () => ({
      withRetry: (fn) => fn(github),
      paginateWithRetry: (method, params) => github.paginate(method, params)
    }) };
const { withRetry, paginateWithRetry } = await createTokenAwareRetry({ github, core });
const prNumber = Number('0') || 0;
const attemptNumber = Number('0') || 0;
const attemptLimit = Number('0') || 0;
const headShaBefore = '';
const gateConclusionBefore =
  '' ||
  (context.payload.workflow_run?.conclusion || '');
const gateRunId =
  '' ||
  String(context.payload.workflow_run?.id || '');
const triggerReason = 'unknown';
const triggerJob = '';
const triggerStep = '';
const stopReason = '';
const codexAutofixResult = 'skipped';
const claudeAutofixResult = 'skipped';
const autofixResult =
  codexAutofixResult && codexAutofixResult !== 'skipped'
    ? codexAutofixResult
    : claudeAutofixResult;
const { owner, repo } = context.repo;
let fixApplied = false;
let headShaAfter = headShaBefore;
let gateResultAfter = gateConclusionBefore || 'unknown';
if (prNumber) {
  try {
    const { data: pr } = await withRetry((client) => client.rest.pulls.get({
      owner,
      repo,
      pull_number: prNumber,
    }));
    headShaAfter = pr.head?.sha || headShaAfter;
      fixApplied = Boolean(
        headShaBefore && headShaAfter && headShaBefore !== headShaAfter
      );
    // Remove autofix:escalated label when fixes are applied
    // This allows re-escalation to the agent if Gate fails again
    if (fixApplied) {
      const prLabels = pr.labels?.map(l => l.name) || [];
      if (prLabels.includes('autofix:escalated')) {
        try {
          await withRetry((client) => client.rest.issues.removeLabel({
            own...

GitHub Actions: Agents Gate Followups / Record autofix metrics: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
 with:
   github-***REDACTED***
   script: const fs = require('fs');
const retryPath = './.github/scripts/github-api-with-retry.js';
const { createTokenAwareRetry } = fs.existsSync(retryPath)
  ? require(retryPath)
  : { createTokenAwareRetry: async () => ({
      withRetry: (fn) => fn(github),
      paginateWithRetry: (method, params) => github.paginate(method, params)
    }) };
const { withRetry, paginateWithRetry } = await createTokenAwareRetry({ github, core });
const prNumber = Number('0') || 0;
const attemptNumber = Number('0') || 0;
const attemptLimit = Number('0') || 0;
const headShaBefore = '';
const gateConclusionBefore =
  '' ||
  (context.payload.workflow_run?.conclusion || '');
const gateRunId =
  '' ||
  String(context.payload.workflow_run?.id || '');
const triggerReason = 'unknown';
const triggerJob = '';
const triggerStep = '';
const stopReason = '';
const codexAutofixResult = 'skipped';
const claudeAutofixResult = 'skipped';
const autofixResult =
  codexAutofixResult && codexAutofixResult !== 'skipped'
    ? codexAutofixResult
    : claudeAutofixResult;
const { owner, repo } = context.repo;
let fixApplied = false;
let headShaAfter = headShaBefore;
let gateResultAfter = gateConclusionBefore || 'unknown';
if (prNumber) {
  try {
    const { data: pr } = await withRetry((client) => client.rest.pulls.get({
      owner,
      repo,
      pull_number: prNumber,
    }));
    headShaAfter = pr.head?.sha || headShaAfter;
      fixApplied = Boolean(
        headShaBefore && headShaAfter && headShaBefore !== headShaAfter
      );
    // Remove autofix:escalated label when fixes are applied
    // This allows re-escalation to the agent if Gate fails again
    if (fixApplied) {
      const prLabels = pr.labels?.map(l => l.name) || [];
      if (prLabels.includes('autofix:escalated')) {
        try {
          await withRetry((client) => client.rest.issues.removeLabel({
            own...

GitHub Actions: Claude Code Review (Opt-in) / Resolve review target: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Use dedicated scripts dir, create if needed�[0m
 �[36;1mINSTALL_DIR=""�[0m
 �[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
 �[36;1m  INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
 �[36;1mfi�[0m
 �[36;1mmkdir -p "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
 �[36;1mcd "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
 �[36;1m�[0m
 �[36;1mcleanup_vendor_aliases() ***�[0m
 �[36;1m  if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  local cleanup_dir="$INSTALL_DIR"�[0m
 �[36;1m  if [ -z "$cleanup_dir" ]; then�[0m
 �[36;1m    echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
 �[36;1m    echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
 �[36;1m    if [ -z "$vendored_alias" ]; then�[0m
 �[36;1m      continue�[0m
 �[36;1m    fi�[0m
 �[36;1m    rm -rf -- "$vendored_alias" || true�[0m
 �[36;1m    local parent_dir�[0m
 �[36;1m    parent_dir=$(dirname "$vendored_alias")�[0m
 �[36;1m    # Remove empty parent directories that may have been created for scoped packages�[0m
 �[36;1m    while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
 �[36;1m      rmdir -- "$parent_dir" 2>/dev/null || break�[0m
 �[36;1m      parent_dir=$(dirname "$parent_dir")�[0m
 �[36;1m    done�[0m
 �[36;1m  done�[0m
 �[36;1m�[0m
 �[36;1m  popd >/dev/null 2>&1 || true�[0m
 �[36;1m***�[0m
 �[36;1m�[0m
 �[36;1mtrap cleanup_vendor_aliases EXIT�[0m
 �[36;1m�[0m
 �[36;1mcreate_vendor_aliases() ***�[0m
 �[36;1m  if [ ! -f "package.json" ];...

GitHub Actions: Claude Code Review (Opt-in) / 5_Resolve review target.txt: chore(deps): update stranske/workflows digest to a0bf67e

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1m# Use dedicated scripts dir, create if needed�[0m
 �[36;1mINSTALL_DIR=""�[0m
 �[36;1mif [ -z "$INSTALL_DIR" ]; then�[0m
 �[36;1m  INSTALL_DIR="$***GITHUB_WORKSPACE***/.github/scripts"�[0m
 �[36;1mfi�[0m
 �[36;1mmkdir -p "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mecho "📦 Installing `@octokit` dependencies in $INSTALL_DIR..."�[0m
 �[36;1mcd "$INSTALL_DIR"�[0m
 �[36;1m�[0m
 �[36;1mdeclare -a VENDORED_ALIAS_DIRS=()�[0m
 �[36;1m�[0m
 �[36;1mcleanup_vendor_aliases() ***�[0m
 �[36;1m  if [ "$***`#VENDORED_ALIAS_DIRS`[@]***" -eq 0 ]; then�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  local cleanup_dir="$INSTALL_DIR"�[0m
 �[36;1m  if [ -z "$cleanup_dir" ]; then�[0m
 �[36;1m    echo "::warning::Install dir is empty, skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if ! pushd "$cleanup_dir" >/dev/null 2>&1; then�[0m
 �[36;1m    echo "::warning::Failed to enter install dir \"$cleanup_dir\"; skipping vendored alias cleanup"�[0m
 �[36;1m    return 0�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  for vendored_alias in "$***VENDORED_ALIAS_DIRS[@]***"; do�[0m
 �[36;1m    if [ -z "$vendored_alias" ]; then�[0m
 �[36;1m      continue�[0m
 �[36;1m    fi�[0m
 �[36;1m    rm -rf -- "$vendored_alias" || true�[0m
 �[36;1m    local parent_dir�[0m
 �[36;1m    parent_dir=$(dirname "$vendored_alias")�[0m
 �[36;1m    # Remove empty parent directories that may have been created for scoped packages�[0m
 �[36;1m    while [ "$parent_dir" != "." ] && [ "$parent_dir" != "/" ]; do�[0m
 �[36;1m      rmdir -- "$parent_dir" 2>/dev/null || break�[0m
 �[36;1m      parent_dir=$(dirname "$parent_dir")�[0m
 �[36;1m    done�[0m
 �[36;1m  done�[0m
 �[36;1m�[0m
 �[36;1m  popd >/dev/null 2>&1 || true�[0m
 �[36;1m***�[0m
 �[36;1m�[0m
 �[36;1mtrap cleanup_vendor_aliases EXIT�[0m
 �[36;1m�[0m
 �[36;1mcreate_vendor_aliases() ***�[0m
 �[36;1m  if [ ! -f "package.json" ];...

Commit Status: Gate / gate: Gate / gate

Conclusion: failure

Path classification was cancelled
🧰 Additional context used
📓 Path-based instructions (6)
{pyproject.toml,.github/workflows/**/*.{yml,yaml}}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Check both pyproject.toml ([tool.coverage.report] fail_under) AND workflow files for coverage-min settings; ensure these match or the lower value will be the effective threshold

Files:

  • .github/workflows/agents-guard.yml
.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

For GitHub Actions workflow startup_failure errors with zero jobs, check for invalid YAML syntax, top-level permissions: block on workflow_call reusable workflows (which conflicts with caller permissions), invalid permission scopes, or circular workflow references

Files:

  • .github/workflows/agents-guard.yml
.github/workflows/*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

  • .github/workflows/agents-guard.yml
.github/workflows/agents-*.yml

📄 CodeRabbit inference engine (CLAUDE.md)

agents-*.yml, autofix.yml, .github/codex/ prompts, and synced scripts/docs should be fixed in stranske/Workflows, not in the consumer repo

Files:

  • .github/workflows/agents-guard.yml
**/.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a documented controlled reason

Files:

  • .github/workflows/agents-guard.yml
{.github/workflows/agents-*.yml,.github/workflows/autofix.yml,.github/codex/**,docs/**}

📄 CodeRabbit inference engine (AGENTS.md)

Synced workflows (agents-*.yml, autofix.yml), prompts in .github/codex/, and synced scripts/docs should be fixed in stranske/Workflows, not locally; do not edit them locally

Files:

  • .github/workflows/agents-guard.yml
🔀 Multi-repo context

Linked repositories findings

stranske/Workflows (inspected refs/pull/2546/head)

  • .github/workflows/agents-guard.yml:103,173 — the repo’s own fallback workflow now pins stranske/Workflows/.github/actions/setup-api-client@a0bf67ebf03ca6767607b6da335fd21a88ebf787. This shows the updated digest exists on the PR branch being used as the source of truth for the action.

stranske/Template (inspected refs/pull/881/head)

  • .github/workflows/agents-guard.yml:114,183 — Template also pins the same stranske/Workflows/.github/actions/setup-api-client@a0bf67ebf03ca6767607b6da335fd21a88ebf787 digest in its fallback path, so this repo is already aligned with the updated Workflows action on the inspected branch.

steps.eligibility.outputs.should-run == 'true' &&
steps.api_client_base.outputs.available != 'true'
uses: "stranske/Workflows/.github/actions/setup-api-client@a525e6e3e2431d302073de65723c6e022f4b02fa" # v1
uses: "stranske/Workflows/.github/actions/setup-api-client@a0bf67ebf03ca6767607b6da335fd21a88ebf787" # v1

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟠 Major | 🏗️ Heavy lift

Don't patch this synced workflow in the consumer repo.

agents-guard.yml is one of the synced agents-*.yml workflows, so this SHA bump needs to land in stranske/Workflows and reach this repo through the normal sync path. Updating it directly here creates source-of-truth drift, especially since the upstream workflows repo already carries the new digest. As per coding guidelines, agents-*.yml, autofix.yml, .github/codex/ prompts, and synced scripts/docs should be fixed in stranske/Workflows, not in the consumer repo and Synced workflows (agents-*.yml, autofix.yml), prompts in .github/codex/, and synced scripts/docs should be fixed in stranske/Workflows, not locally; do not edit them locally.

Also applies to: 183-183

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/agents-guard.yml at line 114, The SHA bump in
agents-guard.yml (the setup-api-client action reference) should not be edited in
this consumer repo because this is a synced agents-*.yml workflow. Revert any
local change here and make the update in stranske/Workflows instead, then let
the normal sync bring it back into this repo; keep the consumer copy unchanged
to avoid source-of-truth drift.

Sources: Coding guidelines, Linked repositories

@stranske

Copy link
Copy Markdown
Owner

Closing as superseded by merged Workflows source updates and Maint 68 sync propagation for stranske/workflows digest changes.

@stranske stranske closed this Jun 30, 2026
@stranske
stranske deleted the renovate/stranske-workflows-digest branch June 30, 2026 05:32
@renovate

renovate Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the stranske/Workflows a0bf67e update again.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant