ci: scheduled Sync workflow-template pins job by dkastl · Pull Request #100 · geolonia/.github

dkastl · 2026-07-22T06:30:29Z

Why

The reusable-workflow SHA pins inside workflow-templates/*.yml are all stuck at v1.16.0 while the repo is at v1.35.0. Dependabot only scans .github/workflows, so it never bumps refs under workflow-templates/, and the org SHA-pin standard forbids a floating @v1/@main ref there. So repos scaffolded/enrolled via the Backstage templates (which fetch these files) start from stale refs.

What

Adds .github/workflows/sync-workflow-template-pins.yml: weekly (+ workflow_dispatch) job that rewrites every geolonia/.github/.github/workflows/reusable-*.yml@<sha> # vX.Y.Z in workflow-templates/*.yml to the latest release SHA + tag, and opens a PR when they drift. Third-party action pins are untouched (left to Dependabot).

Goes through the normal PR path (review + Security Suite) - no direct push to main.
Uses the Workflows GitHub App token (same app the release job uses) so the sync PR triggers checks.
persist-credentials: false, all actions SHA-pinned, vars passed via env (zizmor-clean).

Needs verification before merge

App permission: confirm the Workflows GitHub App has pull_requests: write (it already has contents: write for tag pushes). If not, gh pr create will fail and the app install needs that scope added.
Dry run: trigger via workflow_dispatch on a branch to confirm it produces the expected sync PR (should bump all templates v1.16.0 -> v1.35.0).

Summary by CodeRabbit

Chores
- Added automated weekly and on-demand synchronization of workflow references.
- Automatically prepares a pull request when updated workflow versions are available.
- Preserves floating version references while updating pinned versions for consistency.

Keep the reusable-workflow SHA pins in workflow-templates/*.yml aligned with the latest release. Dependabot only scans .github/workflows, so it never bumps these, and the SHA-pin standard forbids a floating ref in the templates. This weekly job (also workflow_dispatch) rewrites the pins to the latest release SHA and opens a PR when they drift, going through the normal review + Security Suite gate via the Workflows App token.

coderabbitai · 2026-07-22T06:30:37Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: f5713fad-5759-4720-b254-b337ed9e8d9f

📥 Commits

Reviewing files that changed from the base of the PR and between 236b83c and cc68175.

📒 Files selected for processing (1)

.github/workflows/sync-workflow-template-pins.yml

Walkthrough

Changes

Workflow pin synchronization

Layer / File(s)	Summary
Workflow setup and authentication `.github/workflows/sync-workflow-template-pins.yml`	Adds weekly and manual triggers, scoped GitHub App authentication, and a full-history checkout for release tag resolution.
Pin rewrite and pull request publication `.github/workflows/sync-workflow-template-pins.yml`	Resolves the latest release SHA, updates eligible `geolonia` pins, and conditionally commits changes and creates or updates a pull request.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant GeoloniaReleases
  participant WorkflowTemplates
  participant GitHubPullRequests
  GitHubActions->>GeoloniaReleases: Resolve latest release tag and SHA
  GitHubActions->>WorkflowTemplates: Rewrite matching SHA pins
  GitHubActions->>GitHubPullRequests: Push branch and create or update PR

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and clearly points to the new scheduled workflow that syncs workflow-template pins.
Description check	✅ Passed	It explains the motivation, changes, and verification steps, though it doesn't use the template's Summary or Related Issues headings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/sync-workflow-template-pins

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-22T06:30:56Z

🛡️ Security suite

Check	Result
✅ Supply chain · `bumblebee`	No exposure matches
✅ Secrets · `betterleaks`	No secrets in diff
✅ Action pinning · `pinact`	All actions pinned
✅ Actions audit · `zizmor`	No findings

Note

All security checks passed.

_{Updated for cc68175 · workflow run}

Copilot

Pull request overview

Adds an automated GitHub Actions workflow to keep workflow-templates/*.yml reusable-workflow SHA pins aligned with the latest geolonia/.github release, since Dependabot does not update templates outside .github/workflows.

Changes:

Adds a weekly scheduled (and manually dispatchable) workflow to detect and rewrite pinned geolonia/.github reusable workflow refs in workflow-templates/*.yml.
Opens or updates a PR with the rewritten pins using a GitHub App token so checks run on the sync PR.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Request only contents: write + pull-requests: write when minting the Workflows App token, instead of inheriting the app's blanket installation permissions (zizmor dangerous-github-app-token, error severity).

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

.github/workflows/sync-workflow-template-pins.yml:9

The header comment claims the org SHA-pin standard forbids floating @v1/@main refs in workflow-templates, but workflow-templates/security-suite.yml intentionally uses @v1. Consider clarifying here that this job only rewrites SHA-pinned ...@<sha> # vX.Y.Z references, and leaves intentional @v1 templates unchanged, to avoid misleading future maintainers.

# Why a dedicated job: Dependabot only scans .github/workflows, so it never
# bumps refs living under workflow-templates/. The org SHA-pin standard also
# forbids a floating @v1 / @main ref in those templates. So this periodic job
# rewrites the pins to the latest release and opens a PR when they drift; the

.github/workflows/sync-workflow-template-pins.yml:82

Avoid embedding the App token directly in the git push command argument. This repo already uses a safer, consistent pattern of setting origin once (see .github/workflows/reusable-release-auto-on-tag.yml:152) and then pushing to origin, which reduces the chance of the token being echoed in command output/error messages.

          git push --force "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${BRANCH}"

@v1

- Clarify the header comment: SHA-pinned reusable refs are rewritten; security-suite.yml deliberately floats on @v1 (ruleset-required) and is left untouched (the rewrite only matches SHA pins). - Add 'shopt -s nullglob' so an empty glob is a no-op, not a literal path. - Push via an authenticated origin with --force-with-lease (instead of --force to an inline URL) to avoid clobbering concurrent branch updates, matching the release workflow's pattern. (App-token least-privilege scoping was already added in an earlier commit.)

dkastl marked this pull request as ready for review July 22, 2026 06:32

dkastl requested a review from Copilot July 22, 2026 06:32

Copilot started reviewing on behalf of dkastl July 22, 2026 06:33 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread .github/workflows/sync-workflow-template-pins.yml Outdated

Comment thread .github/workflows/sync-workflow-template-pins.yml

Comment thread .github/workflows/sync-workflow-template-pins.yml Outdated

ci: scope the sync job's app token to least privilege

ad4efd0

Request only contents: write + pull-requests: write when minting the Workflows App token, instead of inheriting the app's blanket installation permissions (zizmor dangerous-github-app-token, error severity).

dkastl requested a review from Copilot July 22, 2026 06:47

Copilot started reviewing on behalf of dkastl July 22, 2026 06:48 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread .github/workflows/sync-workflow-template-pins.yml

dkastl merged commit d8154ae into main Jul 22, 2026
6 checks passed

dkastl deleted the chore/sync-workflow-template-pins branch July 22, 2026 06:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: scheduled Sync workflow-template pins job#100

ci: scheduled Sync workflow-template pins job#100
dkastl merged 3 commits into
mainfrom
chore/sync-workflow-template-pins

dkastl commented Jul 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dkastl commented Jul 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Needs verification before merge

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ Security suite

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dkastl commented Jul 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 22, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading