fix: pin required-workflow reusable ref to a SHA (unbreak org-wide Security Suite)#88
Merged
Merged
Conversation
…ite) Regression from #86: making security-suite.yml (the org required workflow) reference reusable-security-suite.yml via a floating @v1 stopped the suite from running on EVERY consumer PR. The ruleset 'require workflows' injector does not run a required workflow whose own reusable is a moving tag, so it silently produced no run and the required 'Security Suite' check hung at 'Expected - waiting for workflow to run' forever (e.g. geolonia-infra-cdk#151). Evidence: the only diff between the last-working release (v1.26.0, SHA-pinned) and current @v1 (v1.28.0, floating) is this one ref; #87's own suite CI ran green with the full @v1 chain as a NORMAL workflow, proving the inner sub-reusable @v1 refs resolve fine at runtime. So only the top-level required-workflow reference is affected. Fix: SHA-pin security-suite.yml -> reusable-security-suite@82a98a9 (v1.28.0). The inner scanner refs (reusable-security-suite -> sub-reusables) and the workflow-templates copy stay @v1; those run as normal reusables/workflows where moving tags work. Net: one-level chain-bump returns for the required workflow itself; sub-reusable changes still float via @v1.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe security-suite.yml workflow's reusable workflow reference is updated from a floating ChangesSecurity suite workflow pin
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
🛡️ Security suite
Note All security checks passed. Updated for |
dkastl
marked this pull request as ready for review
July 6, 2026 00:07
This was referenced Jul 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Regression (org-wide, urgent)
Since #86 / v1.27.0, the Security Suite required check never runs on consumer PRs — it hangs at "Expected — waiting for workflow to run" forever and blocks merge (e.g. geolonia-infra-cdk#151).
Root cause
#86 changed the org required workflow
security-suite.ymlto reference its reusable via a floating@v1(was a SHA pin). The ruleset "require workflows" injector does not run a required workflow whose own reusable is a moving tag — it silently produces no run at all (no check-run, not even a failure), so the required check stays "Expected".Evidence it's exactly this one ref:
@v1(v1.28.0, floating) is this singleuses:line.ci.yml.@v1moved to v1.27.0.@v1chain as a normal workflow — proving the innerreusable-security-suite → sub-reusables@v1(REF3) resolves fine at runtime. Only the top-level required-workflow reference (REF2) is affected.Fix (surgical, one line)
SHA-pin only the required workflow's reusable ref:
reusable-security-suite → sub-reusables) stay@v1— they float fine at runtime.workflow-templates/security-suite.ymlstays@v1— adopted as a normal workflow, moving tags work there.Tradeoff
The treadmill returns only one level: bump this SHA when
reusable-security-suite.ymlitself changes. Sub-reusable changes (the frequent ones) still propagate via@v1with no bump. This is arguably correct anyway — an org-wide required gate should pin its entrypoint reusable immutably.After merge
Cut v1.29.0 →
@v1advances → re-trigger a consumer PR (empty commit on infra-cdk#151) and confirm the Security Suite check actually runs.Validation:
pinact --checkexit 0 (the@v1exemption still covers REF3 + the template);zizmorclean; no em-dashes.Summary by CodeRabbit