Skip to content

fix: bump required-workflow ref to v1.30.0 (whole tree now immutable) [2/2]#90

Merged
dkastl merged 1 commit into
mainfrom
fix/bump-required-workflow-ref-v1.30.0
Jul 6, 2026
Merged

fix: bump required-workflow ref to v1.30.0 (whole tree now immutable) [2/2]#90
dkastl merged 1 commit into
mainfrom
fix/bump-required-workflow-ref-v1.30.0

Conversation

@dkastl

@dkastl dkastl commented Jul 6, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Part 2 of 2 — completes the fix for the org-wide Security Suite required check.

reusable-security-suite@v1.30.0 (#89) SHA-pinned its scanner refs, so pointing security-suite.yml's reusable ref at it makes the entire required-workflow reusable tree immutable:

security-suite.yml  → reusable-security-suite@76db4b3 (v1.30.0, SHA)
  reusable-security-suite → sub-reusables@0d7d0f2 (v1.29.0, SHA)

This is the same shape as the last-known-working v1.25.0 (fully SHA-pinned), now with the #85 severity breakdown + #87 hardening. The ruleset "require workflows" injector needs exactly this (no moving tags anywhere in the tree).

After merge

Cut v1.31.0 → @v1 advances → re-trigger a consumer PR (infra-cdk#151) → confirm the Security Suite check finally runs. That's the real verification; I'll hold the "fixed" call until then.

Validation: pinact --check exit 0, zizmor clean, no em-dashes.

Summary by CodeRabbit

  • Chores
    • Updated the security suite to a newer pinned version for PR checks.

@dkastl
fix: bump required-workflow ref to v1.30.0 (whole tree now immutable)…
4e62f57 
… [2/2]

Part 2 of 2. reusable-security-suite@v1.30.0 (76db4b3) has SHA-pinned scanner
refs (#89), so pointing security-suite.yml's REF2 at it makes the ENTIRE
required-workflow reusable tree immutable. This is the topology the ruleset
'require workflows' injector needs; identical shape to the last-known-working
v1.25.0 but with the #85 severity breakdown + #87 hardening.

After release v1.31.0 and @v1 advancing, re-trigger a consumer PR to confirm
the Security Suite check runs again.
@coderabbitai

coderabbitai Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 08f97f92-a9e8-45df-8ea8-76e96f7204d3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Walkthrough

Updates the pinned commit SHA reference for the reusable security suite workflow in security-suite.yml from v1.28.0 to v1.30.0, changing which version of the suite executes without altering workflow wiring, triggers, concurrency, or permissions.

Changes

Security Suite Version Bump

Layer / File(s) Summary
Pinned SHA update
.github/workflows/security-suite.yml		 The suite job's uses reference to reusable-security-suite.yml is updated from the pinned SHA for v1.28.0 to the pinned SHA for v1.30.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

Suggested labels: github_actions, dependencies

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly states the workflow ref bump to v1.30.0 and matches the main change.
Description check ✅ Passed The description covers the fix, validation, and follow-up steps, with only minor template-heading omissions.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/bump-required-workflow-ref-v1.30.0

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

🛡️ Security suite

Check Result
✅ Supply chain · bumblebee No exposure matches
✅ Secrets · betterleaks No secrets in diff
✅ Action pinning · pinact All actions pinned
✅ Actions audit · zizmor No findings

Note

All security checks passed.

Updated for 4e62f57 · workflow run

@dkastl
dkastl marked this pull request as ready for review July 6, 2026 00:38
@dkastl

dkastl commented Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@dkastl
dkastl merged commit e247b95 into main Jul 6, 2026
6 checks passed
@dkastl
dkastl deleted the fix/bump-required-workflow-ref-v1.30.0 branch July 6, 2026 00:40
@dkastl dkastl mentioned this pull request Jul 6, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dkastl