chore(deps): update actions/setup-python digest to ece7cb0 - #1243
chore(deps): update actions/setup-python digest to ece7cb0#1243renovate[bot] wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughTwelve GitHub Actions workflow files update the pinned commit SHA for Changesactions/setup-python SHA bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agents-decompose.yml:
- Line 32: The SHA bump for the actions/setup-python action in the
agents-decompose.yml workflow file should not be made in this consumer
repository as these agent workflow files are owned upstream in the
stranske/Workflows repository and are synced to this location. Revert the SHA
change on line 32 of agents-decompose.yml back to its original value, then apply
the same update to the corresponding workflow file in the upstream
stranske/Workflows repository instead, following the proper upstream update
process to avoid drift and overwriting issues.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ada7756d-9ada-433c-9252-7abb51a8a483
📒 Files selected for processing (12)
.github/workflows/agents-80-pr-event-hub.yml.github/workflows/agents-auto-label.yml.github/workflows/agents-auto-pilot.yml.github/workflows/agents-capability-check.yml.github/workflows/agents-decompose.yml.github/workflows/agents-dedup.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-verify-to-new-pr.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/backplane-conformance.yml.github/workflows/ci.yml.github/workflows/maint-dependabot-auto-lock.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
stranske/Workflows(auto-detected)stranske/Template(auto-detected)
📜 Review details
🧰 Additional context used
📓 Path-based instructions (5)
**/.github/workflows/**/!(*.md)
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
For workflow_call reusable workflows, do not use top-level permissions: block as it conflicts with caller permissions (documented in docs/INTEGRATION_GUIDE.md)
Files:
.github/workflows/maint-dependabot-auto-lock.yml.github/workflows/backplane-conformance.yml.github/workflows/agents-auto-label.yml.github/workflows/agents-verify-to-new-pr.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/agents-decompose.yml.github/workflows/agents-dedup.yml.github/workflows/agents-80-pr-event-hub.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-auto-pilot.yml.github/workflows/agents-capability-check.yml.github/workflows/ci.yml
**/.github/workflows/*.{yml,yaml}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
For startup_failure in workflows with zero jobs, check for invalid YAML syntax, invalid permission scopes, top-level permissions block on workflow_call, or circular workflow references
Files:
.github/workflows/maint-dependabot-auto-lock.yml.github/workflows/backplane-conformance.yml.github/workflows/agents-auto-label.yml.github/workflows/agents-verify-to-new-pr.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/agents-decompose.yml.github/workflows/agents-dedup.yml.github/workflows/agents-80-pr-event-hub.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-auto-pilot.yml.github/workflows/agents-capability-check.yml.github/workflows/ci.yml
.github/workflows/*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
.github/workflows/*.yml: In this consumer repository, keep most workflow logic instranske/Workflowsand only carry repo-specific configuration unless explicitly documented as an exception
First-party consumers should reference reusable workflows with@mainunless intentionally pinning to an exact commit SHA for a controlled reasonReference reusable workflows with
@mainin first-party consumers unless intentionally pinning to an exact commit SHA for a controlled reason
Files:
.github/workflows/maint-dependabot-auto-lock.yml.github/workflows/backplane-conformance.yml.github/workflows/agents-auto-label.yml.github/workflows/agents-verify-to-new-pr.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/agents-decompose.yml.github/workflows/agents-dedup.yml.github/workflows/agents-80-pr-event-hub.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-auto-pilot.yml.github/workflows/agents-capability-check.yml.github/workflows/ci.yml
.github/workflows/agents-*.yml
📄 CodeRabbit inference engine (CLAUDE.md)
Agent workflow files (
agents-*.yml) are owned by Workflows; fix issues instranske/Workflows, not in this consumer repo
Files:
.github/workflows/agents-auto-label.yml.github/workflows/agents-verify-to-new-pr.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/agents-decompose.yml.github/workflows/agents-dedup.yml.github/workflows/agents-80-pr-event-hub.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-auto-pilot.yml.github/workflows/agents-capability-check.yml
.github/workflows/ci.yml
📄 CodeRabbit inference engine (CLAUDE.md)
ci.ymlis repo-specific and should be edited locally
Files:
.github/workflows/ci.yml
🔀 Multi-repo context stranske/Workflows, stranske/Template
Based on my exploration of the linked repositories, I have gathered sufficient cross-repository context. Let me provide my findings:
Linked repositories findings
stranske/Workflows (Central Reusable Workflows Repository)
Repository Purpose: stranske/Workflows is a central reusable GitHub Actions workflow system that serves 13 registered first-party consumer repositories, including stranske/Template [::stranske/Workflows::]. The synchronization is managed through .github/workflows/maint-68-sync-consumer-repos.yml.
Registered Consumer Repositories: The following repos are automatically synced from Workflows:
- stranske/Template (subject of this PR)
- stranske/Travel-Plan-Permission
- stranske/trip-planner
- stranske/Manager-Database
- stranske/Portable-Alpha-Extension-Model
- stranske/Trend_Model_Project
- stranske/Collab-Admin
- stranske/Counter_Risk
- stranske/Pension-Data
- stranske/Inv-Man-Intake
- stranske/Ready
- stranske/learning-management-system
- stranske/Fine-Art-Archive
[::stranske/Workflows::]
Reusable Workflows Using setup-python: The central repo contains multiple reusable workflows that reference actions/setup-python@v6 (unpinned major version):
.github/workflows/reusable-gemini-run.yml.github/workflows/reusable-cursor-run.yml.github/workflows/reusable-codex-run.yml.github/workflows/reusable-claude-run.yml.github/workflows/reusable-backplane-conformance.yml.github/workflows/reusable-agents-verifier.yml
All use python-version: '3.14' configuration [::stranske/Workflows::].
stranske/Template (Consumer Repository)
Updated Files: This PR updates 11 workflow files in the Template repository that reference the old SHA a309ff8b426b58ec0e2a45f0f869d46889d02405:
.github/workflows/pr-00-gate.yml(5 references).github/workflows/agents-auto-pilot.yml.github/workflows/agents-auto-label.yml.github/workflows/agents-capability-check.yml.github/workflows/agents-decompose.yml.github/workflows/agents-dedup.yml.github/workflows/agents-issue-optimizer.yml.github/workflows/agents-verify-to-new-pr.yml.github/workflows/agents-weekly-metrics.yml.github/workflows/backplane-conformance.yml.github/workflows/agents-80-pr-event-hub.yml
[::stranske/Template::]
Dependency Sync Mechanism: Template includes a ./templates/consumer-repo/ directory that serves as a template for downstream consumer repositories. These templates are synced via the maint-68-sync-consumer-repos.yml workflow. The consumer template directory also contains the same workflow files with pinned SHAs, indicating that this update may cascade to other consumer repositories when they sync [::stranske/Workflows::].
Version Compatibility: All setup-python references use the same major version v6 with pinned digest. The update from a309ff8b... to ece7cb0 is within the same major version, suggesting backwards compatibility for Python 3.14 configuration used across all workflows [::stranske/Template::].
🔇 Additional comments (11)
.github/workflows/agents-80-pr-event-hub.yml (1)
329-329: LGTM!.github/workflows/agents-auto-label.yml (1)
68-68: LGTM!.github/workflows/agents-auto-pilot.yml (1)
219-219: LGTM!.github/workflows/agents-capability-check.yml (1)
37-37: LGTM!.github/workflows/ci.yml (1)
174-174: LGTM!.github/workflows/maint-dependabot-auto-lock.yml (1)
29-29: LGTM!.github/workflows/agents-dedup.yml (1)
41-41: Already covered by the ownership-contract comment on Line 32 in.github/workflows/agents-decompose.yml..github/workflows/agents-issue-optimizer.yml (1)
142-142: Already covered by the ownership-contract comment on Line 32 in.github/workflows/agents-decompose.yml..github/workflows/agents-verify-to-new-pr.yml (1)
95-95: Already covered by the ownership-contract comment on Line 32 in.github/workflows/agents-decompose.yml..github/workflows/agents-weekly-metrics.yml (1)
61-61: Already covered by the ownership-contract comment on Line 32 in.github/workflows/agents-decompose.yml..github/workflows/backplane-conformance.yml (1)
29-29: LGTM!
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 | ||
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Move this SHA bump to the Workflows source repo instead of editing this consumer file.
Line 32 updates an agents-* workflow locally, but these files are owned upstream and synced; this will drift or be overwritten.
As per coding guidelines, .github/workflows/agents-*.yml: “Agent workflow files (agents-*.yml) are owned by Workflows; fix issues in stranske/Workflows, not in this consumer repo.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/agents-decompose.yml at line 32, The SHA bump for the
actions/setup-python action in the agents-decompose.yml workflow file should not
be made in this consumer repository as these agent workflow files are owned
upstream in the stranske/Workflows repository and are synced to this location.
Revert the SHA change on line 32 of agents-decompose.yml back to its original
value, then apply the same update to the corresponding workflow file in the
upstream stranske/Workflows repository instead, following the proper upstream
update process to avoid drift and overwriting issues.
Sources: Coding guidelines, Linked repositories
|
Closing as superseded by stranske/Workflows#2527 and replacement sync PR #1247 from Maint 68 run 28088900646. The setup-python digest is source-owned in Workflows/templates, so the sync PR is the correct propagation path. |
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
1 participant
This PR contains the following updates:
a309ff8→ece7cb0Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.