chore(deps): update stranske/workflows digest to c2537cc

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
stranske/Workflows (changelog)	action	digest	d68de19 → c2537cc

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The pinned commit SHA for the stranske/Workflows/.github/actions/setup-api-client external action is updated in both the pull_request_target and pull_request fallback steps of .github/workflows/agents-guard.yml. No other configuration or logic is changed.

Changes

Action SHA bump

Layer / File(s)	Summary
Update setup-api-client SHA in both fallback steps .github/workflows/agents-guard.yml	The uses reference for the setup-api-client Workflows fallback step is updated to a new pinned commit SHA in both the pull_request_target job (line 114) and the pull_request job (line 183).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• stranske/Ready#350: Updates to the same action SHA pin in .github/workflows/agents-guard.yml.

Suggested labels

automated

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: updating a dependency digest for stranske/workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/stranske-workflows-digest

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Workflow state fingerprint for Keepalive Loop Reporter. Do not edit.

[github-actions]

Workflow state fingerprint for Agents Gate Followups. Do not edit.

[agents-workflows-bot]

Workflow source needed

PR #349 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/agents-guard.yml:
- Line 114: The external action reference
stranske/Workflows/.github/actions/setup-api-client is using an exact commit SHA
pin instead of `@main`, which prevents automatic adoption of future patches.
Replace the commit SHA reference (c2537cc959f2ce05926c4639d25b90678abc97bc) with
`@main` for both occurrences of the setup-api-client action usage. This allows the
action to automatically receive backward-compatible updates without requiring
manual updates in the future.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fd3c0d1d-8eff-42d3-86c5-9fce0e56dfcd

📥 Commits

Reviewing files that changed from the base of the PR and between 9e8f891 and ed2ddb5.

📒 Files selected for processing (1)

• .github/workflows/agents-guard.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Workflows (auto-detected)

📜 Review details

🧰 Additional context used

📓 Path-based instructions (4)

{pyproject.toml,.github/workflows/*.{yml,yaml}}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

{pyproject.toml,.github/workflows/*.{yml,yaml}}: For Python projects with coverage thresholds, ensure both pyproject.toml ([tool.coverage.report] fail_under) and workflow files have matching coverage-min settings, or the lower one will determine the actual threshold
The Manager-Database repository has a coverage threshold of 75%

Files:

• .github/workflows/agents-guard.yml

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

For GitHub Actions workflow startup_failure errors, check for invalid YAML syntax, invalid permissions: block in workflow_call reusable workflows, invalid permission scopes, or circular workflow references

Files:

• .github/workflows/agents-guard.yml

.github/workflows/**/*.{yml,yaml}

📄 CodeRabbit inference engine (CLAUDE.md)

Reference reusable workflows in consumer repos with @main unless intentionally pinning to an exact commit SHA for a controlled reason.

Files:

• .github/workflows/agents-guard.yml

.github/workflows/*.yml

📄 CodeRabbit inference engine (AGENTS.md)

First-party consumers should reference reusable workflows with @main unless intentionally pinning to an exact commit SHA for a controlled reason

Files:

• .github/workflows/agents-guard.yml

🔀 Multi-repo context stranske/Workflows

Based on the previous comprehensive research already conducted, here are the cross-repository findings for this PR:

Linked Repositories Findings

stranske/Workflows [::stranske/Workflows::]

Action Interface Stability:
The setup-api-client action maintains a stable contract across the update from d68de19 to c2537cc:

• Inputs: Multiple optional parameters (secrets, github_token, and fallback individual tokens) remain unchanged
• Outputs: Three stable outputs (token_count, available_tokens, setup_contract) are unmodified
• No changes to the action interface or contract between commits [::stranske/Workflows::]

Release Content (v1.15.2):
The changelog confirms this is a patch-level update containing only:

• A single bug fix: "guard runtime-ac external merge lanes"
• Release date: 2026-06-19 [::stranske/Workflows::]

No Breaking Changes:
The repository's compatibility policy (documented in COMPATIBILITY.md) requires marking breaking changes with a BREAKING prefix in the CHANGELOG. The v1.15.2 release contains no such entries, confirming backward compatibility [::stranske/Workflows::]

Consistent Usage Pattern:
The invocation in .github/workflows/agents-guard.yml follows the standard pattern used across all 73 workflows in the repository:

uses: stranske/Workflows/.github/actions/setup-api-client@c2537cc
with:
  secrets: ${{ toJSON(secrets) }}
  github_token: ${{ secrets.GITHUB_TOKEN }}

This pattern remains fully compatible with the updated action [::stranske/Workflows::]

Assessment: The update from d68de19 to c2537cc is a safe patch-level change with no API modifications, breaking changes, or interface alterations. All dependent workflows will continue to function without modification.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use @main for the external action reference unless there's a documented controlled reason for the commit SHA pinning.

Both lines 114 and 183 reference the external stranske/Workflows/.github/actions/setup-api-client action using an exact commit SHA (c2537cc959...). According to the coding guidelines, first-party consumers should reference reusable workflows with @main unless intentionally pinning to a specific commit for a documented, controlled reason.

The linked repository findings confirm this update (v1.15.2) is backward-compatible and safe, so using @main would allow future patches to be adopted automatically without manual updates.

If commit SHA pinning is intentional (e.g., for reproducibility or a specific Renovate strategy), add an inline comment documenting the controlled reason.

🔧 Recommended fix to use `@main`

- uses: "stranske/Workflows/.github/actions/setup-api-client@c2537cc959f2ce05926c4639d25b90678abc97bc" # v1
+ uses: stranske/Workflows/.github/actions/setup-api-client@main

Apply this change to both lines 114 and 183.

Also applies to: 183-183

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/agents-guard.yml at line 114, The external action
reference stranske/Workflows/.github/actions/setup-api-client is using an exact
commit SHA pin instead of `@main`, which prevents automatic adoption of future
patches. Replace the commit SHA reference
(c2537cc959f2ce05926c4639d25b90678abc97bc) with `@main` for both occurrences of
the setup-api-client action usage. This allows the action to automatically
receive backward-compatible updates without requiring manual updates in the
future.

Source: Coding guidelines

[stranske]

Superseded by the Workflows source-of-truth path: stranske/Workflows#2472 and stranske/Workflows#2498 have merged, and replacement sync PR #357 now carries this generated workflow update without the consumer-local synced-file review debt.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for the stranske/Workflows c2537cc update again.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.