chore(deps): update stranske/workflows digest to c2537cc

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
stranske/Workflows (changelog)	action	digest	d68de19 → c2537cc

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

• Bug Fixes

  • Improved ledger validation to avoid unnecessary commit prefetching when shallow validation is allowed, while preserving strict validation behavior.

• CI/CD

  • Updated the ledger-validation gate to set LEDGER_VALIDATE_ALLOW_SHALLOW=1.
  • Refreshed the workflow API-client fallback to a newly pinned revision and updated the corresponding template drift allowlist.

• Tests

  • Added coverage to verify commit prefetch behavior for both shallow and strict validation scenarios.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR makes two independent updates. First, it pins a new commit SHA for the setup-api-client action in both pull_request_target and pull_request fallback paths of the agents-guard workflow, and documents this re-baseline in the template drift allowlist. Second, it adds shallow ledger validation support by introducing a LEDGER_VALIDATE_ALLOW_SHALLOW environment variable that allows the ledger validation script to skip commit prefetch when missing commits are acceptable, with corresponding test coverage.

Changes

Action SHA Pin Update

Layer / File(s)	Summary
Update pinned SHA in both fallback paths templates/consumer-repo/.github/workflows/agents-guard.yml	Updates the setup-api-client action's pinned commit SHA in both the pull_request_target (line 114) and pull_request (line 183) fallback steps.
Document re-baseline in allowlist config/template-drift-allowlist.txt	The pair.10 allowlist entry is updated with a new template_sha256 fingerprint and reason documenting the 2026-06-22 re-baseline against current Workflows main digest (c2537cc).

Ledger Validation Shallow Fetch Support

Layer / File(s)	Summary
Add environment flag and conditional prefetch logic .github/workflows/pr-00-gate.yml, scripts/ledger_validate.py	Introduces LEDGER_VALIDATE_ALLOW_SHALLOW=1 in the ledger-validation job environment, and modifies ledger_validate.py main() to conditionally invoke commit prefetch only when strict validation is required, skipping prefetch when missing commits are allowed.
Test coverage for prefetch conditions tests/scripts/test_ledger_validate.py, tests/workflows/test_workflow_agents_consolidation.py	Adds test cases covering conditional prefetch behavior: test_main_skips_prefetch_when_missing_commits_allowed verifies prefetch is skipped with LEDGER_VALIDATE_ALLOW_SHALLOW=1, test_main_prefetches_when_missing_commits_are_strict verifies prefetch is called under strict mode, and workflow test validates the environment variable is set in the ledger-validation job.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• stranske/Workflows#2471: Updates the same pinned commit SHA for setup-api-client in the same fallback steps of agents-guard.yml.
• stranske/Workflows#2397: Also modifies config/template-drift-allowlist.txt Health-74 entries for template-drift re-baselining tied to agents-guard.yml consumer action pinning.

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: updating a dependency digest from d68de19 to c2537cc. It is concise and specific, clearly conveying the primary update across the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/stranske-workflows-digest

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[agents-workflows-bot]

Workflow source needed

PR #2472 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[agents-workflows-bot]

Automated Status Summary

Head SHA: 9bb6ff4
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 1

Coverage Trend

Metric	Value
Current	70.38%
Baseline	85.00%
Delta	-14.62%
Minimum	70.00%
Status	✅ Pass

Top Coverage Hotspots (lowest coverage)

File	Coverage	Missing
scripts/check_api_wrapper_guard.py	0.0%	123
scripts/cleanup_labels.py	0.0%	127
scripts/issue_dedup_smoke.py	0.0%	4
scripts/list_registered_consumer_repos.py	0.0%	33
scripts/repo_review_backlog_scan.py	0.0%	203
scripts/repo_review_round1_runner.py	0.0%	225
scripts/repo_review_round1_schema.py	0.0%	194
scripts/runner_lib/__main__.py	0.0%	3
scripts/update_langchain_versions.py	0.0%	34
scripts/validate_dependency_test_setup.py	0.0%	112
scripts/validate_template_completeness.py	0.0%	88
scripts/validate_template_sync.py	0.0%	77
scripts/validate_workflow_yaml.py	0.0%	98
scripts/repo_review_round2_schema.py	8.8%	185
scripts/langchain/topic_splitter.py	19.1%	57

Low Coverage Files (<50.0%)

File	Coverage	Missing
scripts/check_api_wrapper_guard.py	0.0%	123
scripts/cleanup_labels.py	0.0%	127
scripts/issue_dedup_smoke.py	0.0%	4
scripts/list_registered_consumer_repos.py	0.0%	33
scripts/repo_review_backlog_scan.py	0.0%	203
scripts/repo_review_round1_runner.py	0.0%	225
scripts/repo_review_round1_schema.py	0.0%	194
scripts/runner_lib/__main__.py	0.0%	3
scripts/update_langchain_versions.py	0.0%	34
scripts/validate_dependency_test_setup.py	0.0%	112
scripts/validate_template_completeness.py	0.0%	88
scripts/validate_template_sync.py	0.0%	77
scripts/validate_workflow_yaml.py	0.0%	98
scripts/repo_review_round2_schema.py	8.8%	185
scripts/langchain/topic_splitter.py	19.1%	57

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/pr-00-gate.yml:
- Around line 395-396: The ledger-validation job in the template workflow at
templates/consumer-repo/.github/workflows/pr-00-gate.yml is missing the
LEDGER_VALIDATE_ALLOW_SHALLOW environment variable that exists in the main
workflow. Locate the ledger-validation job in the template file and add an env
section containing LEDGER_VALIDATE_ALLOW_SHALLOW set to "1" to keep the template
synchronized with the main workflow and prevent fleet drift.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d51087fc-165c-4de0-b86c-467ab89461b2

📥 Commits

Reviewing files that changed from the base of the PR and between 8de34ce and 80f99e9.

📒 Files selected for processing (4)

• .github/workflows/pr-00-gate.yml
• scripts/ledger_validate.py
• tests/scripts/test_ledger_validate.py
• tests/workflows/test_workflow_agents_consolidation.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Template (auto-detected)
• stranske/Ready (auto-detected)
• stranske/Workflows-Integration-Tests (auto-detected)

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for f in ".github/workflows/pr-00-gate.yml" \
         "templates/consumer-repo/.github/workflows/pr-00-gate.yml"; do
  if [[ ! -f "$f" ]]; then
    echo "MISSING: $f"
    continue
  fi
  echo "=== $f ==="
  rg -n -C2 'ledger-validation|LEDGER_VALIDATE_ALLOW_SHALLOW' "$f" || true
done

Repository: stranske/Workflows

Length of output: 905

---

🏁 Script executed:

#!/bin/bash
# Get lines around the ledger-validation job in the template to see env section
sed -n '402,425p' templates/consumer-repo/.github/workflows/pr-00-gate.yml

Repository: stranske/Workflows

Length of output: 1005

---

Add LEDGER_VALIDATE_ALLOW_SHALLOW environment variable to the template's ledger-validation job.

The main gate workflow at .github/workflows/pr-00-gate.yml:395-396 includes LEDGER_VALIDATE_ALLOW_SHALLOW: "1" in the ledger-validation job env, but the distributed template at templates/consumer-repo/.github/workflows/pr-00-gate.yml does not have this setting. Per coding guidelines, workflow changes must be reflected in both locations to prevent fleet drift.

Add the env section to the template's ledger-validation job:

    env:
      LEDGER_VALIDATE_ALLOW_SHALLOW: "1"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-00-gate.yml around lines 395 - 396, The
ledger-validation job in the template workflow at
templates/consumer-repo/.github/workflows/pr-00-gate.yml is missing the
LEDGER_VALIDATE_ALLOW_SHALLOW environment variable that exists in the main
workflow. Locate the ledger-validation job in the template file and add an env
section containing LEDGER_VALIDATE_ALLOW_SHALLOW set to "1" to keep the template
synchronized with the main workflow and prevent fleet drift.

Source: Coding guidelines