Sync Dependabot action pin comments via reusable workflow - #141
Conversation
Thin caller for basecamp/.github's dependabot-sync-actions-comments reusable workflow (basecamp/.github#8): after CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale pin version comments and pushes back behind a compare-and-swap lease, using the write deploy key scoped to this repo's dependabot-sync environment (deployment branches: default branch only). Also adds workflow_dispatch to test.yml and security.yml so the reusable workflow's CI-dispatch fallback can re-run checks on the pushed head.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
Adds a thin, SHA-pinned GitHub Actions workflow wrapper in this repo to run the basecamp/.github reusable workflow that syncs stale Dependabot # vX.Y.Z action-pin comments after CI completes, plus enables manual dispatch on existing CI/Security workflows to support the reusable workflow’s re-CI fallback.
Changes:
- Add
.github/workflows/dependabot-sync-actions-comments.ymlas aworkflow_run+workflow_dispatchcaller for the reusable workflow at a fixed SHA. - Allow manual runs of CI and Security workflows via
workflow_dispatch.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/test.yml | Adds workflow_dispatch so CI can be manually re-run (e.g., by the sync workflow’s dispatch fallback). |
| .github/workflows/security.yml | Adds workflow_dispatch so security checks can be manually re-run (e.g., by the sync workflow’s dispatch fallback). |
| .github/workflows/dependabot-sync-actions-comments.yml | New workflow that triggers on CI completion for Dependabot github_actions branches and delegates to the SHA-pinned reusable workflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1a1904ce44
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 3 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
…e name Review feedback (Copilot + Codex): a trigger-level branches filter stops workflow runs from being created for non-Dependabot branches (the job-level if only skips the job after the fact), and ci.yml and test.yml both being named CI made the workflow_run anchor fire twice per head and the ci-workflow-name detection ambiguous. test.yml becomes Test (matching basecamp-cli and cli); required status checks are job-name contexts (test, lint, security, race-check) so the rename does not affect the main-gate ruleset. Consolidating ci.yml vs test.yml overlap is left as a follow-up.
Clears the nine stdlib vulnerabilities govulncheck flags in go1.26.1 (GO-2026-4866 et al., all fixed in 1.26.2). The workflows resolve the toolchain from go.mod, so this moves CI and local builds together.
basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
.github/workflows/dependabot-sync-actions-comments.yml:40
inputs.*context is only available forworkflow_dispatch/workflow_callevents. This workflow also runs onworkflow_run, where referencinginputs.branch/inputs.e2ecan cause expression-evaluation errors before the reusable workflow is invoked. Prefer deriving values fromgithub.eventso both triggers work, and pass theworkflow_runhead branch explicitly.
branch: ${{ inputs.branch || '' }}
e2e: ${{ inputs.e2e || false }}
1.26.2 was not enough: govulncheck flags stdlib vulnerabilities fixed across 1.26.3–1.26.5 (GO-2026-5856 in crypto/tls et al.). 1.26.5 is the newest patch release, clearing all five remaining findings.
Thin caller for the
dependabot-sync-actions-commentsreusable workflow (basecamp/.github#8 + #10, pinned at 9ca40e3b). After CI completes on a Dependabotgithub_actionsbranch, trusted default-branch code fixes any stale# vX.Y.Zpin comments — including compound ones with trailing# zizmor: ignore[...]annotations that Dependabot can't rewrite — and pushes back behind a compare-and-swap lease using the write deploy key scoped to this repo'sdependabot-syncenvironment (deployment branches: main only). Validated end-to-end today on a live Dependabot PR in basecamp-cli (basecamp/basecamp-cli#566).Also in this PR:
CI→Test— ci.yml and test.yml both being namedCImade theworkflow_runanchor fire twice per head and the detection name ambiguous. Required status checks are job-name contexts (test,lint,security,race-check), so themain-gateruleset is unaffected. Consolidating the ci.yml/test.yml overlap is left as follow-up.securitycheck (govulncheck) was failing on stdlib vulnerabilities in go1.26.1; fixes span 1.26.3–1.26.5 (GO-2026-5856 et al.), so this jumps to the newest patch release. Workflows resolve the toolchain from go.mod.Sibling callers (all merged): basecamp-sdk#459, basecamp-cli#572/#573, fizzy-cli#189/#190, cli#51/#52.