chore(deps): pin dependencies - #30
Conversation
|
PR author is in the excluded authors list. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Risk: medium. Left a non-blocking comment — Cursor Security Agent was present but skipped, so this is not approved from automated signals. Cursor Bugbot was not present; human review is needed (existing reviewer assignment stands).
Sent by Cursor Approval Agent: Pull Request Router and Approver
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 |
There was a problem hiding this comment.
🔍 Two different digests both labelled v5 for actions/checkout across templates
This template is now pinned to actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5, while the already-pinned workflow-templates/public-repo-guard.yml:45 (and .github/workflows/public-repo-guard.yml:45) uses 93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1. Two distinct commits carrying the same major-version comment is worth a quick verification that fbc6f39… really is the commit the v5 tag points at today (i.e. a newer v5.0.x), otherwise the org templates ship an older checkout than the guard workflow and the # v5 comment is misleading for future manual bumps. Also note the comment style differs (single vs double space before #), a cosmetic inconsistency across the template set.
Was this helpful? React with 👍 or 👎 to provide feedback.
ApprovabilityVerdict: Needs human review Mechanical dependency pinning to commit SHAs is low-risk, but all modified workflow templates are owned by yakimoto while the author owns none of them. The designated owner should review these changes. No code changes detected at You can customize Macroscope's approvability policy. Learn more. |
3de4cf4 to
33a15da
Compare
…mber space Review found a SECOND concurrency collision, on a different axis from the one this template already documents (wave-pen#386). `issue_comment` fires for ISSUES as well as PRs, and GitHub draws both from ONE number sequence. So a comment on Issue #30 and a `/review` on PR #30 entered the same concurrency group. Concurrency is evaluated at WORKFLOW level, BEFORE the job-level `if:` runs — so the Issue comment cancelled the PR review already in flight, and was then skipped itself, having done nothing. That is the identical shape as the #386 defect the block above exists to fix, one axis over: a run that will not review taking the lane from the run that would have. #386 separated the two EVENTS; it did not separate the two number spaces inside one event. pull_request PR 433 -> pr-agent-pull_request-pr-433 issue_comment on PR 30 -> pr-agent-issue_comment-pr-30 issue_comment on ISSUE 30 -> pr-agent-issue_comment-issue-30 The last two used to be one group. actionlint and zizmor clean. Upstream: wave-av/wave-foundation-public#73. Refs wave-pen#418, wave-pen#417. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This PR contains the following updates:
11d5960fbc6f39Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.