fix(ci): pin dependabot-rebase reusable workflow to SHA - #121
Conversation
|
Self-review complete — changes are minimal and correct:
@don-petry please review and merge when CI is green. |
📝 WalkthroughWalkthroughThe reusable Dependabot rebase workflow reference in ChangesDependabot Workflow Compliance
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Pins the Dependabot rebase reusable workflow reference to an immutable commit SHA to satisfy action-pinning compliance, while aligning the caller stub with the current org standards template.
Changes:
- Pin reusable workflow
uses:from@v1to@ee22b427cbce9ecadcf2b436acb57c3adf0cb63d. - Add
workflow_dispatchtrigger for manual queue flushes. - Update job permissions to
contents: write/pull-requests: writeand switch fromsecrets: inheritto explicitAPP_ID/APP_PRIVATE_KEYsecret passing.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| secrets: | ||
| APP_ID: ${{ secrets.APP_ID }} | ||
| APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} |
There was a problem hiding this comment.
The header comment still says "Required org/repo secrets (inherited)", but this workflow now passes secrets explicitly via the secrets: mapping. Please update that wording so it matches the actual configuration (e.g., remove "inherited" or note they are passed explicitly).
Outdated review (superseded by re-review at
|
|
Auto-rebase failed — merge conflict — this branch has conflicts with Please resolve the conflicts and push: |
![petry-projects-pr-review-agent[bot]](https://avatars.githubusercontent.com/u/258516906?s=60&v=4){kind=small}
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
|
@claude Please address all open review comments on this PR from CodeRabbit and Copilot. |
|
Claude encountered an error —— View job I'll analyze this and get back to you. |
Resolves action-pinning compliance finding (issue #88). - Pin `dependabot-rebase-reusable.yml` from mutable `@v1` tag to commit SHA `ee22b427cbce9ecadcf2b436acb57c3adf0cb63d` (v1 tag, looked up via gh api repos/petry-projects/.github/git/refs/tags/v1) - Sync file with current standards template: - Add `workflow_dispatch` trigger for manual queue flush - Upgrade job permissions from `read` → `write` (required by reusable) - Switch from `secrets: inherit` to explicit APP_ID/APP_PRIVATE_KEY block - Update AGENTS comment to match template wording Closes #88 Co-authored-by: don-petry <don-petry@users.noreply.github.com>
12a30f1 to
1cc92c6
Compare
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-rebase.yml:
- Line 44: Update the pinned commit SHA on the uses line so the reusable
workflow references the current v1 commit: replace the old SHA
ee22b427cbce9ecadcf2b436acb57c3adf0cb63d with the new SHA
d3d768dabb7f28cc63283cdfe48630da53700e50 in the uses declaration (the line
starting with "uses:
petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@... #
v1") so it reads uses:
petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@d3d768dabb7f28cc63283cdfe48630da53700e50
# v1.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 72938a9c-a7f2-4ef0-a58e-9b0175606133
📒 Files selected for processing (1)
.github/workflows/dependabot-rebase.yml
| contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) | ||
| pull-requests: write # re-approve PRs after branch update | ||
| uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@v1 | ||
| uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
PINNED_SHA="ee22b427cbce9ecadcf2b436acb57c3adf0cb63d"
CURRENT_V1_SHA="$(gh api repos/petry-projects/.github/git/ref/tags/v1 --jq '.object.sha')"
echo "Pinned SHA: ${PINNED_SHA}"
echo "Current v1 SHA: ${CURRENT_V1_SHA}"
if [[ "${PINNED_SHA}" != "${CURRENT_V1_SHA}" ]]; then
echo "Mismatch: update .github/workflows/dependabot-rebase.yml to @${CURRENT_V1_SHA}"
exit 1
fi
echo "Pinned SHA matches current v1."Repository: petry-projects/TalkTerm
Length of output: 283
Update Line 44 to pin the current v1 commit.
The pinned SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d is stale. The current v1 tag points to d3d768dabb7f28cc63283cdfe48630da53700e50. Update the uses line to uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@d3d768dabb7f28cc63283cdfe48630da53700e50 # v1.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-rebase.yml at line 44, Update the pinned commit
SHA on the uses line so the reusable workflow references the current v1 commit:
replace the old SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d with the new SHA
d3d768dabb7f28cc63283cdfe48630da53700e50 in the uses declaration (the line
starting with "uses:
petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@... #
v1") so it reads uses:
petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@d3d768dabb7f28cc63283cdfe48630da53700e50
# v1.
|
@dev-lead - please fix this PR |
Review — fix requested (cycle 2/3)The automated review identified the following issues. Please address each one: Findings to fixAutomated review — NEEDS HUMAN REVIEWRisk: LOW SummarySingle-line SHA-pin change is a clear security improvement with no risk. However two gates fail: the branch has been CONFLICTING since April 26 (auto-rebase bot gave up), and the pinned SHA ee22b427 is stale — v1 has since moved to at least d3d768da per CodeRabbit. Author must resolve conflicts and refresh the SHA before this can merge. Findings
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review. Additional tasks
The review cascade will automatically re-review after new commits are pushed. |
|
Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead. |
Pull request was closed
Summary
dependabot-rebase-reusable.ymlfrom mutable@v1tag to commit SHAee22b427cbce9ecadcf2b436acb57c3adf0cb63d(the resolved commit for the v1 tag, verified viagh api repos/petry-projects/.github/git/refs/tags/v1)petry-projects/.github/standards/workflows/dependabot-rebase.yml):workflow_dispatchtrigger for manual queue flushread→write(required by the reusable workflow)secrets: inheritto explicitAPP_ID/APP_PRIVATE_KEYsecrets blockCompliance
Resolves the
action-pinningcompliance finding from the weekly audit. See standards/ci-standards.md#action-pinning-policy.Closes #88
Generated with Claude Code
Summary by CodeRabbit