chore(deps): update stranske/workflows digest to 62ed0a8

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
stranske/Workflows (changelog)	action	digest	c2537cc → 62ed0a8

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

• Chores
  • Refreshed pinned fallback workflow actions to the latest available revisions for pull request workflows.
  • Updated the template-drift allowlist entry for the affected workflow to match the newly refreshed action digests and re-baselined fingerprints.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8b1eca49-1420-494c-a263-61b5b077ffcd

📥 Commits

Reviewing files that changed from the base of the PR and between 6a15108 and 5e975c7.

📒 Files selected for processing (2)

• .github/workflows/agents-guard.yml
• config/template-drift-allowlist.txt

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Template (auto-detected)
• stranske/Fine-Art-Archive (auto-detected)
• stranske/Ready (auto-detected)
• stranske/Workflows-Integration-Tests (auto-detected)

---

📝 Walkthrough

Walkthrough

Two workflow files — the main repository and template consumer repository agents-guard workflows — have their setup-api-client fallback action pinned to a new commit SHA in both pull_request_target and pull_request paths. The corresponding allowlist entry for agents-guard is re-baselined with updated fingerprints and a refreshed reason note.

Changes

Setup-api-client pin bump and allowlist re-baselining

Layer / File(s)	Summary
Update setup-api-client pin in agents-guard workflows .github/workflows/agents-guard.yml, templates/consumer-repo/.github/workflows/agents-guard.yml	The uses: reference for the setup-api-client fallback action is bumped to a new commit SHA in both the pull_request_target and pull_request fallback steps in both the main repository (lines 103–106, 173–176) and template consumer repository (lines 111–117, 180–186).
Re-baseline allowlist entry for agents-guard pair config/template-drift-allowlist.txt	The Health 74 template-drift allowlist entry for agents-guard (pair.10) is re-baselined with refreshed main_sha256 and template_sha256 fingerprints and an updated reason reflecting the 2026-06-22 re-baseline with the new Workflows main digest.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• stranske/Workflows#2397: Both PRs update the Health 74 config/template-drift-allowlist.txt allowlist (re-baselining/refreshing the allowlisted fingerprints/reasons for workflow template pairs after action pin/version changes), including changes that track updates to the same pinned consumer workflow actions.
• stranske/Workflows#2471: Both the main PR and retrieved PR update the pinned stranske/Workflows/.github/actions/setup-api-client Git ref in templates/consumer-repo/.github/workflows/agents-guard.yml (fallback steps) and correspondingly adjust config/template-drift-allowlist.txt entries for the agents-guard pair.
• stranske/Workflows#2472: Both PRs modify the agents-guard.yml "Workflows fallback" setup-api-client action pin (and the corresponding config/template-drift-allowlist.txt pair.10 fingerprints/reason) to a different stranske/Workflows digest, so they touch the same code paths.

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: updating the stranske/workflows dependency digest from c2537cc to 62ed0a8, which is reflected in all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/stranske-workflows-digest

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[agents-workflows-bot]

Workflow source needed

PR #2503 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[stranske-keepalive]

Automated Status Summary

Head SHA: 1355e49
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@templates/consumer-repo/.github/workflows/agents-guard.yml`:
- Line 114: The setup-api-client action SHA has been patched directly in
templates/consumer-repo/.github/workflows/agents-guard.yml at lines 114 and 183,
but this file is sync-managed and should not be edited locally. Revert the SHA
bump in the template file back to the `@v1` reference. Then either make the SHA
update in the stranske/Workflows repository and sync it back to this consumer
repository, or if this is a documented repo-specific exception, update both
.github/workflows/agents-guard.yml and
templates/consumer-repo/.github/workflows/agents-guard.yml with the same change
in this PR to maintain synchronization between the main workflow and the
template workflow.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 73f6ee0d-5f60-4d6e-8882-32ec107c0b97

📥 Commits

Reviewing files that changed from the base of the PR and between 62ed0a8 and 6a15108.

📒 Files selected for processing (1)

• templates/consumer-repo/.github/workflows/agents-guard.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Template (auto-detected)
• stranske/Fine-Art-Archive (auto-detected)
• stranske/Ready (auto-detected)
• stranske/Workflows-Integration-Tests (auto-detected)

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Do not patch agents-guard.yml locally; this introduces sync drift.

Line 114 and Line 183 bump the fallback SHA directly in templates/consumer-repo/.github/workflows/agents-guard.yml, but this file is sync-managed. The provided .github/workflows/agents-guard.yml context still points to @v1, so the two workflow sources are now out of sync.

Please make this change in stranske/Workflows and sync it back, or update both workflow locations in the same PR if this repo-specific exception is explicitly documented.

As per coding guidelines, "templates/consumer-repo/.github/workflows/agents-*.yml: Do not edit agents-*.yml workflows locally; fix issues in stranske/Workflows and sync back to this consumer repository" and "**/.github/workflows/*.{yml,yaml}: Any change to workflows that consumers use must be reflected in BOTH .github/workflows/ (main workflow) and templates/consumer-repo/.github/workflows/ (template)`."

Also applies to: 183-183

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@templates/consumer-repo/.github/workflows/agents-guard.yml` at line 114, The
setup-api-client action SHA has been patched directly in
templates/consumer-repo/.github/workflows/agents-guard.yml at lines 114 and 183,
but this file is sync-managed and should not be edited locally. Revert the SHA
bump in the template file back to the `@v1` reference. Then either make the SHA
update in the stranske/Workflows repository and sync it back to this consumer
repository, or if this is a documented repo-specific exception, update both
.github/workflows/agents-guard.yml and
templates/consumer-repo/.github/workflows/agents-guard.yml with the same change
in this PR to maintain synchronization between the main workflow and the
template workflow.

Source: Coding guidelines

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.