Sync Dependabot action pin comments via reusable workflow - #189
Conversation
Thin caller for basecamp/.github's dependabot-sync-actions-comments reusable workflow (basecamp/.github#8): after CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale pin version comments and pushes back behind a compare-and-swap lease, using the write deploy key scoped to this repo's dependabot-sync environment (deployment branches: default branch only). Also adds workflow_dispatch to test.yml and security.yml so the reusable workflow's CI-dispatch fallback can re-run checks on the pushed head.
One-time catch-up applying what the new sync workflow will maintain automatically: version comments on SHA-pinned uses lines whose trailing zizmor annotations prevented Dependabot from rewriting them.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
Adds a thin, SHA-pinned caller workflow to keep Dependabot github_actions branches’ action pin comments (# vX.Y.Z, including # zizmor: ignore[...] suffixes) in sync using trusted default-branch reusable workflow code from basecamp/.github, and enables manual dispatch on existing CI/security workflows to support the re-CI loop after a push-back.
Changes:
- Add
dependabot-sync-actions-comments.ymlworkflow that triggers onworkflow_run(CI completion) andworkflow_dispatch, calling the SHA-pinned reusable workflow. - Enable
workflow_dispatchonCIandSecurityworkflows. - Update one stale pin comment in
release.ymlforactions/setup-goto# v7.0.0.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/test.yml | Adds workflow_dispatch so CI can be re-run via dispatch. |
| .github/workflows/security.yml | Adds workflow_dispatch so security checks can be re-run via dispatch. |
| .github/workflows/release.yml | Updates the setup-go pin comment to the current version label. |
| .github/workflows/dependabot-sync-actions-comments.yml | Adds a caller workflow that invokes the SHA-pinned reusable sync workflow on CI completion / manual dispatch. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 4 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Review feedback: the job-level if only skips the job after the run is created; a trigger-level branches filter stops runs from being created for non-Dependabot branches at all. The if stays as defense-in-depth.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 447780fd3d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Thin caller for the
dependabot-sync-actions-commentsreusable workflow (basecamp/.github#8, merged as 95a9f7a2). After CI completes on a Dependabotgithub_actionsbranch, trusted default-branch code fixes any stale# vX.Y.Zpin comments — including compound ones with trailing# zizmor: ignore[...]annotations that Dependabot can't rewrite — and pushes back behind a compare-and-swap lease.Security model (openclaw-basecamp lineage, hardened after basecamp-sdk#458 review): the Dependabot head branch is fetched as data and never executed; the push uses a write deploy key scoped to this repo's
dependabot-syncenvironment, whose deployment branch policy allows only the default branch (App tokens can't push workflow-file changes at all). Environment + deploy key are already provisioned.Also adds
workflow_dispatchto test.yml and security.yml so the reusable workflow's CI-dispatch fallback can re-run checks on the pushed head (the other repos already had it).Second commit is a one-time catch-up running the updater against current workflows: 1 stale comment in release.yml (setup-go v6.4.0→v7.0.0).
Runtime validation: after merge, a
workflow_dispatchrun against a live Dependabot actions branch (basecamp-cli#566 is the standing candidate) proves the full fix→guard→push→re-CI loop.Summary by cubic
Automates syncing of GitHub Actions pin version comments on Dependabot
github_actionsbranches using the SHA-pinned reusable workflow frombasecamp/.github. Adds a trigger-level branch filter for safety, and updates one stale comment inrelease.ymlforactions/setup-gotov7.0.0..github/workflows/dependabot-sync-actions-comments.ymlto rewrite stale# vX.Y.Zpin comments (including with# zizmor: ignore[...]), fetch the Dependabot head as data, and push via thedependabot-syncdeploy key; includes a trigger-levelworkflow_runfilter fordependabot/github_actions/**with a job-level guard for defense-in-depth.workflow_dispatchonCIandSecurityworkflows so checks can re-run on the pushed head.Written for commit 447780f. Summary will update on new commits.