chore(deps): bump the github-actions group with 5 updates - #112
chore(deps): bump the github-actions group with 5 updates#112dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [geolonia/.github/.github/workflows/reusable-release-auto-on-tag.yml](https://github.com/geolonia/.github) | `1` | `1.36.0` | | [geolonia/.github/.github/workflows/reusable-bumblebee-scan.yml](https://github.com/geolonia/.github) | `1` | `1.36.0` | | [geolonia/.github/.github/workflows/reusable-secret-leak-check.yml](https://github.com/geolonia/.github) | `1` | `1.36.0` | | [geolonia/.github/.github/workflows/reusable-pinact-check.yml](https://github.com/geolonia/.github) | `1` | `1.36.0` | | [geolonia/.github/.github/workflows/reusable-security-suite.yml](https://github.com/geolonia/.github) | `1` | `1.36.0` | Updates `geolonia/.github/.github/workflows/reusable-release-auto-on-tag.yml` from 1 to 1.36.0 - [Release notes](https://github.com/geolonia/.github/releases) - [Commits](v1...v1.36.0) Updates `geolonia/.github/.github/workflows/reusable-bumblebee-scan.yml` from 1 to 1.36.0 - [Release notes](https://github.com/geolonia/.github/releases) - [Commits](v1...v1.36.0) Updates `geolonia/.github/.github/workflows/reusable-secret-leak-check.yml` from 1 to 1.36.0 - [Release notes](https://github.com/geolonia/.github/releases) - [Commits](v1...v1.36.0) Updates `geolonia/.github/.github/workflows/reusable-pinact-check.yml` from 1 to 1.36.0 - [Release notes](https://github.com/geolonia/.github/releases) - [Commits](v1...v1.36.0) Updates `geolonia/.github/.github/workflows/reusable-security-suite.yml` from 1 to 1.36.0 - [Release notes](https://github.com/geolonia/.github/releases) - [Commits](v1...v1.36.0) --- updated-dependencies: - dependency-name: geolonia/.github/.github/workflows/reusable-release-auto-on-tag.yml dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: geolonia/.github/.github/workflows/reusable-bumblebee-scan.yml dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: geolonia/.github/.github/workflows/reusable-secret-leak-check.yml dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: geolonia/.github/.github/workflows/reusable-pinact-check.yml dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: geolonia/.github/.github/workflows/reusable-security-suite.yml dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
WalkthroughThe release and security GitHub Actions workflows now pin reusable workflow references to ChangesWorkflow version pinning
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
🛡️ Security suite
Warning Warnings only. These do not block the PR, but please review them. Updated for |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-auto-on-tag.yml:
- Around line 12-14: The comments at .github/workflows/release-auto-on-tag.yml
lines 12-14 and .github/workflows/security-suite.yml lines 43-52 incorrectly
describe pinned nested workflows as floating on `@v1`. Update the release workflow
comment to state that its pinned version requires explicit updates, and update
the security-suite comment similarly for the nested workflow while retaining the
explanation that the outer required workflow uses `@v1`.
In @.github/workflows/reusable-security-suite.yml:
- Line 59: Pin all five v1.36.0 reusable workflow references to commit
82fb51be9f5a20f4e75762bb0cabcfab9ff20a21, preserving the # v1.36.0 comment:
update .github/workflows/reusable-security-suite.yml lines 59-59, 67-67, and
74-74; .github/workflows/release-auto-on-tag.yml line 14; and
.github/workflows/security-suite.yml line 52.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: cc020190-5399-4c80-90e5-59d965a60f6c
📒 Files selected for processing (3)
.github/workflows/release-auto-on-tag.yml.github/workflows/reusable-security-suite.yml.github/workflows/security-suite.yml
| # Float on @v1 (this is a normal, non-required workflow) so we pick up the | ||
| # lightweight-tag peel fix and future release-workflow changes automatically. | ||
| uses: geolonia/.github/.github/workflows/reusable-release-auto-on-tag.yml@v1 | ||
| uses: geolonia/.github/.github/workflows/reusable-release-auto-on-tag.yml@v1.36.0 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Make the version-management comments match the pinned behavior.
Both comments claim that the nested workflow floats on @v1 and receives future updates automatically. The new references require explicit version bumps.
.github/workflows/release-auto-on-tag.yml#L12-L14: document explicit updates to the pinned release..github/workflows/security-suite.yml#L43-L52: document explicit updates to the pinned nested workflow while retaining the outer required-workflowv1explanation.
🧰 Tools
🪛 GitHub Check: suite / action-pinning / pinact (verify pins)
[failure] 14-14: pinact error
uses: 82fb51b # v1.36.0
📍 Affects 2 files
.github/workflows/release-auto-on-tag.yml#L12-L14(this comment).github/workflows/security-suite.yml#L43-L52
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-auto-on-tag.yml around lines 12 - 14, The comments
at .github/workflows/release-auto-on-tag.yml lines 12-14 and
.github/workflows/security-suite.yml lines 43-52 incorrectly describe pinned
nested workflows as floating on `@v1`. Update the release workflow comment to
state that its pinned version requires explicit updates, and update the
security-suite comment similarly for the nested workflow while retaining the
explanation that the outer required workflow uses `@v1`.
| pull-requests: write | ||
| issues: write | ||
| uses: geolonia/.github/.github/workflows/reusable-bumblebee-scan.yml@v1 | ||
| uses: geolonia/.github/.github/workflows/reusable-bumblebee-scan.yml@v1.36.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- workflow references ---'
for f in .github/workflows/reusable-security-suite.yml \
.github/workflows/release-auto-on-tag.yml \
.github/workflows/security-suite.yml; do
echo "[$f]"
rg -n -C 1 'geolonia/\.github/.+@v1\.36\.0' "$f" || true
done
printf '%s\n' '--- tag resolution ---'
if command -v gh >/dev/null 2>&1; then
ref_json="$(gh api repos/geolonia/.github/git/ref/tags/v1.36.0)"
printf '%s\n' "$ref_json" | jq '{object_type:.object.type, object_sha:.object.sha}'
type="$(printf '%s\n' "$ref_json" | jq -r '.object.type')"
sha="$(printf '%s\n' "$ref_json" | jq -r '.object.sha')"
if [ "$type" = tag ]; then
commit_sha="$(gh api "repos/geolonia/.github/git/tags/$sha" --jq '.object.sha')"
else
commit_sha="$sha"
fi
printf 'resolved_commit=%s\n' "$commit_sha"
gh api "repos/geolonia/.github/commits/$commit_sha" --jq '{sha:.sha, message:.commit.message}'
else
echo 'gh is unavailable'
fiRepository: geolonia/.github
Length of output: 2226
Pin all five v1.36.0 reusable workflows to commit 82fb51be9f5a20f4e75762bb0cabcfab9ff20a21. Keep the # v1.36.0 version comment at each reference.
🧰 Tools
🪛 GitHub Check: suite / action-pinning / pinact (verify pins)
[failure] 59-59: pinact error
uses: 82fb51b # v1.36.0
📍 Affects 3 files
.github/workflows/reusable-security-suite.yml#L59-L59(this comment).github/workflows/reusable-security-suite.yml#L67-L67.github/workflows/reusable-security-suite.yml#L74-L74.github/workflows/release-auto-on-tag.yml#L14-L14.github/workflows/security-suite.yml#L52-L52
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/reusable-security-suite.yml at line 59, Pin all five
v1.36.0 reusable workflow references to commit
82fb51be9f5a20f4e75762bb0cabcfab9ff20a21, preserving the # v1.36.0 comment:
update .github/workflows/reusable-security-suite.yml lines 59-59, 67-67, and
74-74; .github/workflows/release-auto-on-tag.yml line 14; and
.github/workflows/security-suite.yml line 52.
Source: Linters/SAST tools
|
Closing: this change is not correct for this repo, and the pinning suggestion in review should not be applied. These five references float on On the review suggestion to SHA-pin all five: our docs say the opposite in as many words — "Floating reusable refs … are fine … Do not SHA-pin them thinking it fixes an 'Expected' hang; that was a red herring during the outage." Applying it would lock the suite into exactly the chain-bump treadmill the design avoids. The related observation that the comments no longer match the code was accurate — #114 adds a Dependabot |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
#114) Dependabot rewrote this repo's deliberate @v1 self-references to @v1.36.0 (#112, now closed). That breaks the single-release model the security suite and release workflow rely on, and it silently loses the .pinact.yml exemption, which only matches a bare major tag (ActionVersion ^v[0-9]+$) — so pinact then demands a SHA pin, which the docs explicitly warn against. Ignore the five reusables referenced at @v1. Listed individually rather than as geolonia/.github/*, because this repo also SHA-pins reusable-backstage- techdocs.yml and reusable-route-issue.yml the way a consumer would, and those must keep receiving SHA bumps.
Bumps the github-actions group with 5 updates:
11.36.011.36.011.36.011.36.011.36.0Updates
geolonia/.github/.github/workflows/reusable-release-auto-on-tag.ymlfrom 1 to 1.36.0Release notes
Sourced from geolonia/.github/.github/workflows/reusable-release-auto-on-tag.yml's releases.
... (truncated)
Commits
d32aef4feat: make the suite's action-pinning check warn-only (#76)df41a3dfeat: pinact warn-only mode + centralized .pinact.yml fallback (#75)689f126feat: thin-caller suite + picker template; retire individual templates (#74)de8cd27chore(deps): bump the github-actions group across 1 directory with 4 updates ...63e21d7feat: add reusable-security-suite.yml (single source for the suite) (#73)c98b846feat: add Security Suite workflow (one-stop, ruleset-enforceable) (#71)Updates
geolonia/.github/.github/workflows/reusable-bumblebee-scan.ymlfrom 1 to 1.36.0Release notes
Sourced from geolonia/.github/.github/workflows/reusable-bumblebee-scan.yml's releases.
... (truncated)
Commits
d32aef4feat: make the suite's action-pinning check warn-only (#76)df41a3dfeat: pinact warn-only mode + centralized .pinact.yml fallback (#75)689f126feat: thin-caller suite + picker template; retire individual templates (#74)de8cd27chore(deps): bump the github-actions group across 1 directory with 4 updates ...63e21d7feat: add reusable-security-suite.yml (single source for the suite) (#73)c98b846feat: add Security Suite workflow (one-stop, ruleset-enforceable) (#71)Updates
geolonia/.github/.github/workflows/reusable-secret-leak-check.ymlfrom 1 to 1.36.0Release notes
Sourced from geolonia/.github/.github/workflows/reusable-secret-leak-check.yml's releases.
... (truncated)
Commits
d32aef4feat: make the suite's action-pinning check warn-only (#76)df41a3dfeat: pinact warn-only mode + centralized .pinact.yml fallback (#75)689f126feat: thin-caller suite + picker template; retire individual templates (#74)de8cd27chore(deps): bump the github-actions group across 1 directory with 4 updates ...63e21d7feat: add reusable-security-suite.yml (single source for the suite) (#73)c98b846feat: add Security Suite workflow (one-stop, ruleset-enforceable) (#71)Updates
geolonia/.github/.github/workflows/reusable-pinact-check.ymlfrom 1 to 1.36.0Release notes
Sourced from geolonia/.github/.github/workflows/reusable-pinact-check.yml's releases.
... (truncated)
Commits
d32aef4feat: make the suite's action-pinning check warn-only (#76)df41a3dfeat: pinact warn-only mode + centralized .pinact.yml fallback (#75)689f126feat: thin-caller suite + picker template; retire individual templates (#74)de8cd27chore(deps): bump the github-actions group across 1 directory with 4 updates ...63e21d7feat: add reusable-security-suite.yml (single source for the suite) (#73)c98b846feat: add Security Suite workflow (one-stop, ruleset-enforceable) (#71)Updates
geolonia/.github/.github/workflows/reusable-security-suite.ymlfrom 1 to 1.36.0Release notes
Sourced from geolonia/.github/.github/workflows/reusable-security-suite.yml's releases.
... (truncated)
Commits
d32aef4feat: make the suite's action-pinning check warn-only (#76)df41a3dfeat: pinact warn-only mode + centralized .pinact.yml fallback (#75)689f126feat: thin-caller suite + picker template; retire individual templates (#74)de8cd27chore(deps): bump the github-actions group across 1 directory with 4 updates ...63e21d7feat: add reusable-security-suite.yml (single source for the suite) (#73)c98b846feat: add Security Suite workflow (one-stop, ruleset-enforceable) (#71)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit