chore(deps): update actions/setup-python action to v7 - #2795
Merged
Conversation
github-actions
Bot
added
the
agents:allow-change
Contributor
Workflow source neededPR #2795 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
Contributor
Automated Status SummaryHead SHA: da24d56
Coverage Overview
Coverage Trend
Top Coverage Hotspots (lowest coverage)
Low Coverage Files (<50.0%)
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeNo scope information available Tasks
Acceptance criteria
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Semgrep OSS found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eb27bf5e79
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }} | ||
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | ||
| - uses: actions/setup-python@v6 | ||
| - uses: actions/setup-python@v7.0.0 |
There was a problem hiding this comment.
This switches the required Gate docs-guard job to actions/setup-python@v7.0.0, but as of 2026-07-20 the official actions/setup-python tags list v6.3.0/v6 as latest and there is no matching v7 branch. Because this ref is neither the SHA used elsewhere in the patch nor an existing tag/branch, GitHub Actions cannot download the action and the Gate will fail before any checks run.
Useful? React with 👍 / 👎.
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | ||
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 |
There was a problem hiding this comment.
This new pinned SHA makes the existing repo tests stale: tests/scripts/test_consumer_sync_shadow_handoff.py::test_workflow_has_no_write_or_apply_surface still asserts the old actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 string, and tests/workflows/test_template_drift_workflow.py similarly asserts actions/setup-python@v6 for health-74-template-drift.yml. Any run of those workflow tests after dependencies are installed will fail even if the action itself resolves, so the assertions need to be updated with the workflow change.
Useful? React with 👍 / 👎.
renovate
Bot
force-pushed
the
renovate/actions-setup-python-7.x
branch
from
July 20, 2026 08:29
eb27bf5 to
26134c3
Compare
stranske
temporarily deployed
to
agent-high-privilege
July 20, 2026 12:36 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
| if: steps.eligibility.outputs.should-run == 'true' | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| id: app_token | ||
| uses: actions/create-github-app-token@v3 |
| with: | ||
| client-id: ${{ secrets.WORKFLOWS_APP_CLIENT_ID || '0' }} | ||
| private-key: ${{ secrets.WORKFLOWS_APP_PRIVATE_KEY || 'dummy' }} | ||
| owner: ${{ github.repository_owner }} |
Comment on lines
+130
to
+255
| # Use exact array match (not substring) to avoid matching agents:auto-pilot-failed/pause | ||
| if: > | ||
| ( | ||
| github.event_name != 'issues' || | ||
| contains(toJson(github.event.issue.labels.*.name), 'agent:') || | ||
| contains(toJson(github.event.issue.labels.*.name), 'agents:') || | ||
| ( | ||
| github.event.action == 'unlabeled' && | ||
| ( | ||
| startsWith(github.event.label.name, 'agent:') || | ||
| startsWith(github.event.label.name, 'agents:') | ||
| ) | ||
| ) | ||
| ) && | ||
| !contains(github.event.issue.labels.*.name, 'agents:auto-pilot') | ||
| name: Normalize workflow inputs | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| mode: ${{ steps.determine.outputs.mode }} | ||
| should_run_bridge: ${{ steps.determine.outputs.should_run_bridge }} | ||
| should_run_sync: ${{ steps.determine.outputs.should_run_sync }} | ||
| intake_mode: ${{ steps.normalize.outputs.intake_mode }} | ||
| target_repo: ${{ steps.normalize.outputs.target_repo }} | ||
| source: ${{ steps.normalize.outputs.source }} | ||
| raw_input: ${{ steps.normalize.outputs.raw_input }} | ||
| source_url: ${{ steps.normalize.outputs.source_url }} | ||
| debug: ${{ steps.normalize.outputs.debug }} | ||
| issue_number: ${{ steps.normalize.outputs.issue_number }} | ||
| post_codex_comment: ${{ steps.normalize.outputs.post_codex_comment }} | ||
| bridge_agent: ${{ steps.normalize.outputs.bridge_agent }} | ||
| bridge_draft_pr: ${{ steps.normalize.outputs.bridge_draft_pr }} | ||
| apply_langchain_formatting: ${{ steps.normalize.outputs.apply_langchain_formatting }} | ||
| steps: | ||
| - name: Determine mode | ||
| id: determine | ||
| - name: Normalize inputs | ||
| id: normalize | ||
| env: | ||
| INPUT_INTAKE_MODE: ${{ inputs.intake_mode }} | ||
| INPUT_SOURCE: ${{ inputs.source }} | ||
| INPUT_RAW_INPUT: ${{ inputs.raw_input }} | ||
| INPUT_SOURCE_URL: ${{ inputs.source_url }} | ||
| INPUT_DEBUG: ${{ inputs.debug }} | ||
| INPUT_ISSUE_NUMBER: ${{ inputs.issue_number }} | ||
| INPUT_POST_CODEX_COMMENT: ${{ inputs.post_codex_comment }} | ||
| INPUT_BRIDGE_AGENT: ${{ inputs.bridge_agent }} | ||
| INPUT_BRIDGE_DRAFT_PR: ${{ inputs.bridge_draft_pr }} | ||
| INPUT_APPLY_LANGCHAIN_FORMATTING: ${{ inputs.apply_langchain_formatting }} | ||
| run: | | ||
| echo "DEBUG: event_name=${{ github.event_name }}" | ||
| echo "DEBUG: inputs.mode=${{ inputs.mode }}" | ||
| if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then | ||
| mode="${{ inputs.mode || 'agent_bridge' }}" | ||
| else | ||
| # Issue events always use agent_bridge mode | ||
| mode="agent_bridge" | ||
| # Handle boolean inputs from workflow_dispatch vs workflow_call | ||
| normalize_bool() { | ||
| local value="$1" | ||
| if [ "$value" = "true" ] || [ "$value" = "True" ] || [ "$value" = "TRUE" ]; then | ||
| echo "true" | ||
| else | ||
| echo "false" | ||
| fi | ||
| } | ||
|
|
||
| event_name="${GITHUB_EVENT_NAME}" | ||
|
|
||
| intake_mode="${INPUT_INTAKE_MODE:-}" | ||
| source_input="${INPUT_SOURCE:-}" | ||
| raw_input="${INPUT_RAW_INPUT:-}" | ||
| source_url="${INPUT_SOURCE_URL:-}" | ||
| debug=$(normalize_bool "${INPUT_DEBUG:-}") | ||
| issue_number="${INPUT_ISSUE_NUMBER:-}" | ||
| post_codex_input="${INPUT_POST_CODEX_COMMENT:-}" | ||
| bridge_agent="${INPUT_BRIDGE_AGENT:-}" | ||
| draft_pr=$(normalize_bool "${INPUT_BRIDGE_DRAFT_PR:-}") | ||
| apply_formatting=$(normalize_bool "${INPUT_APPLY_LANGCHAIN_FORMATTING:-}") | ||
|
|
||
| payload_issue="" | ||
| if command -v jq >/dev/null 2>&1; then | ||
| payload_issue=$(jq -r '.issue.number // empty' "$GITHUB_EVENT_PATH") | ||
| fi | ||
| echo "DEBUG: final mode=${mode}" | ||
| echo "mode=${mode}" >> "$GITHUB_OUTPUT" | ||
|
|
||
| if [[ "${mode}" == "agent_bridge" ]]; then | ||
| echo "should_run_bridge=true" >> "$GITHUB_OUTPUT" | ||
| echo "should_run_sync=false" >> "$GITHUB_OUTPUT" | ||
| elif [[ "${mode}" == "chatgpt_sync" ]]; then | ||
| echo "should_run_bridge=false" >> "$GITHUB_OUTPUT" | ||
| echo "should_run_sync=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "should_run_bridge=false" >> "$GITHUB_OUTPUT" | ||
| echo "should_run_sync=false" >> "$GITHUB_OUTPUT" | ||
| if [ -z "$issue_number" ]; then | ||
| issue_number="$payload_issue" | ||
| fi | ||
|
|
||
| # Gate for agent_bridge mode: only proceed if issue has agent:* or agents:* label | ||
| # Skip when agents:auto-pilot is present - auto-pilot handles the full pipeline | ||
| # Use exact array match (not substring) to avoid matching agents:auto-pilot-failed/pause | ||
| check_labels: | ||
| needs: route | ||
| if: | | ||
| needs.route.outputs.should_run_bridge == 'true' && | ||
| (github.event_name != 'issues' || | ||
| contains(toJson(github.event.issue.labels.*.name), 'agent:') || | ||
| contains(toJson(github.event.issue.labels.*.name), 'agents:')) && | ||
| !contains(github.event.issue.labels.*.name, 'agents:auto-pilot') | ||
| if [ -z "$bridge_agent" ]; then | ||
| bridge_agent="codex" | ||
| fi | ||
|
|
||
| if command -v jq >/dev/null 2>&1 && [ -f "$GITHUB_EVENT_PATH" ]; then | ||
| event_agent=$(jq -r ' | ||
| [ | ||
| .issue.labels[]?.name | ||
| | select(test("^agents?:[A-Za-z0-9-]+$")) | ||
| | sub("^agents?:(?<key>[A-Za-z0-9-]+)$"; "\(.key)") | ||
| | select(. != "keepalive") | ||
| ][0] // empty | ||
| ' "$GITHUB_EVENT_PATH" 2>/dev/null || echo '') | ||
| if [ -n "$event_agent" ]; then | ||
| bridge_agent="$event_agent" | ||
| fi | ||
| fi | ||
| bridge_agent="${bridge_agent,,}" | ||
|
|
||
| if [ -z "$intake_mode" ]; then | ||
| if [ "$event_name" = "issues" ]; then | ||
| intake_mode="agent_bridge" | ||
| else | ||
| intake_mode="chatgpt_sync" | ||
| fi | ||
| fi | ||
|
|
||
| if [ -z "$post_codex_input" ]; then | ||
| if [ "$intake_mode" = "agent_bridge" ]; then | ||
| post_codex_input="true" | ||
| else | ||
| post_codex_input="false" | ||
| fi | ||
| fi | ||
| post_codex=$(normalize_bool "$post_codex_input") | ||
|
|
||
| { | ||
| echo "intake_mode=$intake_mode" | ||
| echo "source=$source_input" | ||
| echo "raw_input=$raw_input" | ||
| echo "source_url=$source_url" | ||
| echo "debug=$debug" | ||
| echo "issue_number=$issue_number" | ||
| echo "post_codex_comment=$post_codex" | ||
| echo "bridge_agent=$bridge_agent" | ||
| echo "bridge_draft_pr=$draft_pr" | ||
| echo "apply_langchain_formatting=$apply_formatting" | ||
| } >> "$GITHUB_OUTPUT" | ||
|
|
||
| chatgpt_sync: | ||
| needs: normalize_inputs |
| secrets: ${{ toJSON(secrets) }} | ||
| github_token: ${{ github.token }} | ||
| - name: Echo received inputs | ||
| run: | |
| secrets: ${{ toJSON(secrets) }} | ||
| github_token: ${{ github.token }} | ||
|
|
||
| - name: Format issues |
Comment on lines
+400
to
+408
| with: | ||
| repository: stranske/Workflows | ||
| sparse-checkout: | | ||
| scripts/langchain/topic_splitter.py | ||
| sparse-checkout-cone-mode: false | ||
| path: .workflows-lib | ||
|
|
||
| - name: Parse topics | ||
| if: steps.prepare.outputs.has_input == 'true' |
Comment on lines
+1339
to
+1347
| sparse-checkout: | | ||
| .github/actions/setup-api-client | ||
| .github/scripts/error_classifier.js | ||
| .github/scripts/github-api-with-retry.js | ||
| .github/scripts/token_load_balancer.js | ||
| sparse-checkout-cone-mode: false | ||
| - name: Inspect label contract | ||
| id: inspect | ||
| env: |
Comment on lines
+1479
to
+1480
| - name: Setup Python | ||
| uses: actions/setup-python@v7 |
| npm install --no-save --no-package-lock @octokit/rest @octokit/auth-app | ||
|
|
||
| - name: Setup API client | ||
| uses: ./.github/actions/setup-api-client |
| if: steps.check.outputs.should_run == 'true' | ||
| run: | | ||
| set -euo pipefail | ||
| npm install --no-save --no-package-lock @octokit/rest @octokit/auth-app |
Contributor
❌ Sync Manifest Validation FailedThis PR modifies files that should be synced to consumer repos, Required action: Update Why this mattersFiles not declared in the manifest won't be synced to consumer repos How to fix
See the workflow logs for specific files that need to be added. |
stranske
temporarily deployed
to
agent-high-privilege
July 20, 2026 12:52 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
stranske
temporarily deployed
to
agent-high-privilege
July 20, 2026 13:01 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
|
Runner dispatch state for codex on PR #2795. Do not edit. |
Contributor
❌ Sync Manifest Validation FailedThis PR modifies files that should be synced to consumer repos, Required action: Update Why this mattersFiles not declared in the manifest won't be synced to consumer repos How to fix
See the workflow logs for specific files that need to be added. |
stranske
temporarily deployed
to
agent-high-privilege
July 20, 2026 13:22 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
This was referenced Jul 24, 2026
stranske
added a commit
that referenced
this pull request
Jul 24, 2026
…summary) (#2821) * Make template-drift check pin-tolerant so Renovate bumps stop reddening it Health 74 Template Drift went red on main after every Renovate action-pin bump (#2799, and #2795 queued next), forcing a manual allowlist re-baseline each time — the 4th such re-baseline just landed (#2815). Root cause: normalize_text only stabilized line endings/whitespace, so a `uses: <action>@<sha> # vX` bump changed the fingerprint and staled the allowlist, even though consumer templates SHA-pin by contract while root floats major tags (an intentional, permanent divergence). Fix at the source: canonicalize GitHub Actions `uses:` refs in normalize_text — `uses: <action>@<ref>` (+ trailing `# vX` comment) collapses to `<action>@<pinned>`. The action PATH is preserved, so swapping to a different action is still drift and genuine logic changes still register; only the mutable pin ref is ignored. This makes action-pin bumps and the pinned-vs-floating divergence invisible to the check, so the allowlist stops going stale on dependency bumps. - scripts/check_template_drift.py: add _canonicalize_action_refs; apply in normalize_text. - tests: 6 new cases — SHA bump not drift, pinned==floating, different action still drift, reusable-workflow ref bump not drift / path change is, and a deliberate-break proving real logic drift still fails despite canonicalization. - config/template-drift-allowlist.txt: regenerated all 15 fingerprints under the new normalization (reasons preserved; 2026-07-24b note added). Verified: a simulated checkout SHA bump leaves the checker green (exit 0) with NO re-baseline; a real logic change still fails (exit 1). 25 drift tests pass. Workflows-repo-internal check only (consumers never run it) — no fleet blast radius. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Apply ruff format to drift-check tests Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Make backplane reference-run staleness non-blocking for the required suite The backplane registry's reference-run evidence has a 7-day freshness window (stale_after_hours=168). When it lapses, validate_registry() emitted a plain finding, so test_registry_has_no_tbd_placeholders_and_validates — which runs in `python ci` (the REQUIRED `summary` check) on every PR — went red, blocking ALL Workflows PRs until someone manually refreshed the evidence. There is no scheduled refresh, so this recurs weekly (it tripped 2026-07-24 ~14:29Z at 170.8h). Freshness is an OPERATIONAL concern, not a structural defect: an aged-but- well-formed reference run does not make the registry invalid. Separate the two: - Finding gains a `severity` field ("error" default; "stale" for the freshness lapse). Add blocking_findings() = structural (error) findings only. - The general structural test asserts blocking_findings(...) == [], tolerating a stale finding — so the required suite stops going red for unrelated PRs. - The CLI (`main`) and the dedicated, NON-required backplane lane (health-78, path-triggered) still exit 1 on staleness, so the freshness signal is preserved where it belongs instead of gating the whole fleet. - Tests: staleness is classified non-blocking; a deliberate-break proves structural defects (missing sha256) still block. Future-dated/malformed timestamps remain blocking errors. Scope: only reference-run staleness is reclassified. Deeper follow-up (auto- refresh the reference run, or schedule the conformance run) left for later. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Apply black formatting (repo uses black, not ruff format) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
stranske
added a commit
that referenced
this pull request
Jul 24, 2026
#2817) * Make template-drift check pin-tolerant so Renovate bumps stop reddening it Health 74 Template Drift went red on main after every Renovate action-pin bump (#2799, and #2795 queued next), forcing a manual allowlist re-baseline each time — the 4th such re-baseline just landed (#2815). Root cause: normalize_text only stabilized line endings/whitespace, so a `uses: <action>@<sha> # vX` bump changed the fingerprint and staled the allowlist, even though consumer templates SHA-pin by contract while root floats major tags (an intentional, permanent divergence). Fix at the source: canonicalize GitHub Actions `uses:` refs in normalize_text — `uses: <action>@<ref>` (+ trailing `# vX` comment) collapses to `<action>@<pinned>`. The action PATH is preserved, so swapping to a different action is still drift and genuine logic changes still register; only the mutable pin ref is ignored. This makes action-pin bumps and the pinned-vs-floating divergence invisible to the check, so the allowlist stops going stale on dependency bumps. - scripts/check_template_drift.py: add _canonicalize_action_refs; apply in normalize_text. - tests: 6 new cases — SHA bump not drift, pinned==floating, different action still drift, reusable-workflow ref bump not drift / path change is, and a deliberate-break proving real logic drift still fails despite canonicalization. - config/template-drift-allowlist.txt: regenerated all 15 fingerprints under the new normalization (reasons preserved; 2026-07-24b note added). Verified: a simulated checkout SHA bump leaves the checker green (exit 0) with NO re-baseline; a real logic change still fails (exit 1). 25 drift tests pass. Workflows-repo-internal check only (consumers never run it) — no fleet blast radius. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Apply ruff format to drift-check tests Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 31, 2026
Owner
|
Requested Renovate rebase/retry to restore this branch to a clean bot-owned dependency delta. The mixed-provenance work was classified before requesting the rebuild:
#2853 adds the durable dependency-repair promotion contract so future coding-agent repairs retain their benefits on an agent-owned replacement without contaminating the bot branch. Keep this PR open until Renovate replaces the head; then re-evaluate the fresh diff, checks, and active non-outdated threads. |
renovate
Bot
force-pushed
the
renovate/actions-setup-python-7.x
branch
from
July 31, 2026 15:40
d7a5a35 to
bdfad28
Compare
renovate
Bot
force-pushed
the
renovate/actions-setup-python-7.x
branch
from
July 31, 2026 16:41
bdfad28 to
d212f6f
Compare
Owner
|
@renovate rebase |
1 similar comment
Owner
|
@renovate rebase |
stranske
enabled auto-merge (squash)
July 31, 2026 16:51
stranske
removed their request for review
July 31, 2026 19:22
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v6→v7Release Notes
actions/setup-python (actions/setup-python)
v7.0.0Compare Source
v7Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.