fix(ci): pin standards reusables to default-branch HEAD - #91
Conversation
This repo's standards reusable pins are re-pointed at the standards default-branch HEAD, resolved live at sweep time. The prior refs are recorded in the verification line below. Three kinds of drift are repaired together and the body does not claim which one this repo had: an UNREACHABLE sha kills the run at workflow STARTUP, so GitHub reports no check at all rather than a failing one and the gate disappears instead of going red; a FLOATING ref (@main) is unpinned supply chain; a merely STALE but reachable sha silently reintroduces every bug fixed since it. files=6 pins=6 perms=0 permlines=0 from=092dedada188f56c5915f74a5fd40aac093742c3,5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 target=8f2ee508 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (6)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (26)
🔇 Additional comments (6)
📝 SummarySummary by CodeRabbit
WalkthroughSix GitHub Actions workflows now pin reusable workflows to newer commits. The workflow logic remains unchanged. ChangesReusable workflow pin updates
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to This updates six reusable GitHub Actions workflow pins to a newer immutable commit, restoring current shared workflow references without changing local workflow behavior or permissions. No merge-blocking risk is identified. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each workflow line Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
Re-points this repo's
hyperpolymath/standardsreusable-workflow pins at the standards default-branch HEAD,8f2ee50841e216cd8c192eeb68953118190f105c.Why this is not a routine version bump.
uses: org/repo/.github/workflows/x.yml@<ref>is resolved at workflow startup, so a bad ref is not a failing job — it is no job at all. This campaign repairs three kinds of drift and does not assume which one this repo had:gh pr checkssimply lists fewer rows. A repo in this state looks greener than one with working gates;@mainruns, but unpinned — the supply-chain property the estate pins for is absent;The refs this repo was actually pinned to, before this PR:
092dedada188f56c5915f74a5fd40aac093742c3 5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236.Expect this PR to surface failures that main does not show. Those failures are revealed, not introduced — they are the gates resuming work after being silently absent. The honest comparison is the set of check names emitted here versus on
main, not pass/fail counts. On the canary (hyperpolymath/empty-linter#79) the governance suite was absent on main and emitted 25 checks once repaired.The target is default-branch HEAD resolved at sweep time, never a sha copied from a plan: a reachable but non-HEAD sha silently reintroduces every bug fixed since it.
Engine:
.git-private-farm/scripts/smtp-notify-sweep.sh --campaign campaigns/pin-repair.sh. Verification for this repo:files=6 pins=6 perms=0 permlines=0 from=092dedada188f56c5915f74a5fd40aac093742c3,5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236 target=8f2ee508 sig=G eb5b2b0 canon=a7325fbdc356 base=main🤖 Generated with Claude Code
https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB