Drop the CI-dispatch fallback — verify and warn instead - #10
Merged
Conversation
Codex review on fizzy-cli#189 (P1, valid): gh workflow run <wf> --ref <dependabot-branch> executes the BRANCH's workflow definitions — the freshly bumped, unreviewed action pins — under workflow_dispatch, outside the Dependabot-restricted pull_request context, with whatever permissions those jobs declare (e.g. security-events: write). That violates this workflow's own no-unreviewed-code-executes invariant, and the fallback is nearly-dead code anyway: deploy-key pushes fire normal pull_request synchronize events. Verify CI appeared on the new head and warn a maintainer if not; never dispatch branch workflows.
There was a problem hiding this comment.
Pull request overview
This PR removes the “CI dispatch fallback” from the reusable Dependabot sync workflow to avoid executing unreviewed branch workflow definitions under workflow_dispatch. Instead, it polls for an expected pull_request CI run on the newly pushed head commit and emits a warning for maintainers if CI does not appear.
Changes:
- Removed the
dispatch-workflowsinput and allgh workflow run ... --ref <dependabot-branch>fallback behavior. - Added a “verify CI started” step that polls for a matching
pull_requestActions run on the new head SHA, then warns if none is found. - Updated inline documentation/comments to explain the security rationale and the new maintainer action (“re-run checks from the PR page”).
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jeremy
added a commit
to basecamp/basecamp-sdk
that referenced
this pull request
Jul 27, 2026
basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not.
jeremy
added a commit
to basecamp/hey-cli
that referenced
this pull request
Jul 27, 2026
basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not.
This was referenced Jul 27, 2026
Merged
jeremy
added a commit
to basecamp/cli
that referenced
this pull request
Jul 27, 2026
…ck (#52) basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not.
jeremy
added a commit
to basecamp/fizzy-cli
that referenced
this pull request
Jul 27, 2026
…ck (#190) basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not.
jeremy
added a commit
to basecamp/basecamp-cli
that referenced
this pull request
Jul 27, 2026
…ck (#573) basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not.
jeremy
added a commit
to basecamp/basecamp-sdk
that referenced
this pull request
Jul 27, 2026
* CI: sync Dependabot action pin comments via reusable workflow Thin caller for basecamp/.github's dependabot-sync-actions-comments reusable workflow (basecamp/.github#8): after CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale pin version comments and pushes back behind a compare-and-swap lease, using the write deploy key scoped to this repo's dependabot-sync environment (deployment branches: main only). Replaces the push-triggered port withdrawn from #458: that lineage executed the freshly-bumped unreviewed checkout action with a write token, and GITHUB_TOKEN cannot push workflow-file changes at all. * CI: filter workflow_run to dependabot branches at the trigger Review feedback: the job-level if only skips the job after the run is created; a trigger-level branches filter stops runs from being created for non-Dependabot branches at all. The if stays as defense-in-depth. * CI: re-pin dependabot-sync reusable workflow past the dispatch fallback basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not.
jeremy
added a commit
to basecamp/hey-cli
that referenced
this pull request
Jul 27, 2026
* ci: sync Dependabot action pin comments via reusable workflow Thin caller for basecamp/.github's dependabot-sync-actions-comments reusable workflow (basecamp/.github#8): after CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale pin version comments and pushes back behind a compare-and-swap lease, using the write deploy key scoped to this repo's dependabot-sync environment (deployment branches: default branch only). Also adds workflow_dispatch to test.yml and security.yml so the reusable workflow's CI-dispatch fallback can re-run checks on the pushed head. * ci: filter workflow_run to dependabot branches; give test.yml a unique name Review feedback (Copilot + Codex): a trigger-level branches filter stops workflow runs from being created for non-Dependabot branches (the job-level if only skips the job after the fact), and ci.yml and test.yml both being named CI made the workflow_run anchor fire twice per head and the ci-workflow-name detection ambiguous. test.yml becomes Test (matching basecamp-cli and cli); required status checks are job-name contexts (test, lint, security, race-check) so the rename does not affect the main-gate ruleset. Consolidating ci.yml vs test.yml overlap is left as a follow-up. * deps: require Go 1.26.2 Clears the nine stdlib vulnerabilities govulncheck flags in go1.26.1 (GO-2026-4866 et al., all fixed in 1.26.2). The workflows resolve the toolchain from go.mod, so this moves CI and local builds together. * ci: re-pin dependabot-sync reusable workflow past the dispatch fallback basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not. * deps: require Go 1.26.5 1.26.2 was not enough: govulncheck flags stdlib vulnerabilities fixed across 1.26.3–1.26.5 (GO-2026-5856 in crypto/tls et al.). 1.26.5 is the newest patch release, clearing all five remaining findings.
This was referenced Jul 27, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Codex flagged a valid P1 on fizzy-cli#189 that applies to the whole model (including the openclaw-basecamp original): the fallback
gh workflow run <wf> --ref <dependabot-branch>executes the branch's workflow definitions — the freshly bumped, unreviewed action pins — underworkflow_dispatch, outside the Dependabot-restrictedpull_requestcontext, with whatever permissions those jobs declare (e.g.security-events: writein security.yml). That violates the workflow's own "no unreviewed branch code executes" invariant.The fallback is nearly-dead code anyway: deploy-key pushes fire normal
pull_requestsynchronize events, so CI starts on its own (openclaw's live runs confirmed this — the dispatch was retained "as a fallback, not the norm"). Replace it with verify-and-warn: poll for apull_requestCI run on the new head; if none appears, emit a warning telling a maintainer to re-run checks from the PR page. Drops thedispatch-workflowsinput.Callers need no changes beyond re-pinning (the input was never passed explicitly); pin bumps follow in each repo. Worth upstreaming to openclaw-basecamp too.