chore(deps): update actions/setup-python digest to ece7cb0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-python (changelog)	action	digest	a309ff8 → ece7cb0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Summary by CodeRabbit

• Chores
  • Refreshed the pinned actions/setup-python revision used by multiple GitHub Actions workflows across the repository and consumer templates to keep CI environment setup consistent.
  • Updated the template drift allowlist fingerprints to match the refreshed workflow template baselines, ensuring ongoing drift detection remains accurate.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 645bf00b-4352-4752-922a-0331cde69d96

📥 Commits

Reviewing files that changed from the base of the PR and between d58a5f3 and 71592ed.

📒 Files selected for processing (1)

• config/template-drift-allowlist.txt

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Template (auto-detected)
• stranske/Fine-Art-Archive (auto-detected)
• stranske/Ready (auto-detected)
• stranske/Workflows-Integration-Tests (auto-detected)

---

📝 Walkthrough

Walkthrough

The workflow files update pinned actions/setup-python revisions, and the template drift allowlist refreshes stored SHA-256 fingerprints and its re-baseline note.

Changes

Workflow Python setup pins

Layer / File(s)

Summary

Update workflow Python setup pins .github/workflows/agents-auto-pilot.yml, .github/workflows/agents-issue-optimizer.yml, .github/workflows/agents-verify-to-new-pr.yml, templates/consumer-repo/.github/workflows/agents-80-pr-event-hub.yml, templates/consumer-repo/.github/workflows/agents-auto-label.yml, templates/consumer-repo/.github/workflows/agents-auto-pilot.yml, templates/consumer-repo/.github/workflows/agents-capability-check.yml, templates/consumer-repo/.github/workflows/agents-decompose.yml, templates/consumer-repo/.github/workflows/agents-dedup.yml, templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml, templates/consumer-repo/.github/workflows/agents-verify-to-new-pr.yml, templates/consumer-repo/.github/workflows/agents-weekly-metrics.yml, templates/consumer-repo/.github/workflows/backplane-conformance.yml, templates/consumer-repo/.github/workflows/pr-00-gate.yml

Workflow steps that set up Python are re-pinned to new actions/setup-python commit SHAs across repository workflows and consumer template workflows. pr-00-gate.yml updates five jobs.

Template drift allowlist refresh

Layer / File(s)	Summary
Refresh allowlist fingerprints config/template-drift-allowlist.txt	The allowlist comment block and multiple SHA-256 entries are updated for the referenced workflow template pairs.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

• 🔄 Consumer repo drift detected #2210 — Updates workflow template SHAs and the drift allowlist, matching the same re-baselining area touched here.

Possibly related PRs

• stranske/Workflows#2397 — Also changes config/template-drift-allowlist.txt for Health 74 template-drift re-baselining.

Suggested reviewers

• stranske

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: updating the actions/setup-python digest to ece7cb0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/actions-setup-python-digest

---

_{Comment @coderabbitai help to get the list of available commands.}

[stranske-keepalive]

Workflow source needed

PR #2527 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.

[stranske-keepalive]

Automated Status Summary

Head SHA: b4b6b02
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / guard
Required: core tests (3.12): ⏳ pending, core tests (3.13): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@templates/consumer-repo/.github/workflows/agents-auto-label.yml`:
- Line 68: The setup-python action SHA update in agents-auto-label.yml was
edited directly in the consumer template, but this is a sync-managed workflow
file that should only be modified through the stranske/Workflows repository.
Revert the change to agents-auto-label.yml in
templates/consumer-repo/.github/workflows/ and instead apply the same
setup-python SHA bump in the source stranske/Workflows repository, then allow
the sync manifest automation (.github/sync-manifest.yml) to propagate the change
back to this consumer repository to maintain consistency.

In `@templates/consumer-repo/.github/workflows/pr-00-gate.yml`:
- Line 213: The actions/setup-python action reference in the template file uses
a pinned SHA digest while the root file uses a version tag, creating a parity
mismatch between templates/consumer-repo/.github/workflows/pr-00-gate.yml and
the root .github/workflows/pr-00-gate.yml. Since these files are synced (with
overwrite_repos: [stranske/Template]), they must remain byte-aligned. Either
update the root file to use the pinned SHA
ece7cb06caefa5fff74198d8649806c4678c61a1 to match the template, or update the
template file to use the version tag `@v6` to match the root. Choose one approach
for consistency and document the rationale in a comment explaining why the
pinned or unpinned approach was selected.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6168ab80-a73f-4bb6-904e-a2bb412748ae

📥 Commits

Reviewing files that changed from the base of the PR and between f329dbd and d58a5f3.

📒 Files selected for processing (14)

• .github/workflows/agents-auto-pilot.yml
• .github/workflows/agents-issue-optimizer.yml
• .github/workflows/agents-verify-to-new-pr.yml
• templates/consumer-repo/.github/workflows/agents-80-pr-event-hub.yml
• templates/consumer-repo/.github/workflows/agents-auto-label.yml
• templates/consumer-repo/.github/workflows/agents-auto-pilot.yml
• templates/consumer-repo/.github/workflows/agents-capability-check.yml
• templates/consumer-repo/.github/workflows/agents-decompose.yml
• templates/consumer-repo/.github/workflows/agents-dedup.yml
• templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml
• templates/consumer-repo/.github/workflows/agents-verify-to-new-pr.yml
• templates/consumer-repo/.github/workflows/agents-weekly-metrics.yml
• templates/consumer-repo/.github/workflows/backplane-conformance.yml
• templates/consumer-repo/.github/workflows/pr-00-gate.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• stranske/Template (auto-detected)
• stranske/Fine-Art-Archive (auto-detected)
• stranske/Ready (auto-detected)
• stranske/Workflows-Integration-Tests (auto-detected)

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[stranske]

Approved for the dependency cleanup campaign: active review threads are resolved, current Gate and CodeRabbit checks are passing, and this source update is needed before closing the downstream setup-python digest PRs.