chore(ai): sync to ai-workflows@v0.2.9 - #254
Conversation
Manual sync (propagate.yml could not open a cross-repo PR — AI_WORKFLOWS_PAT is not set on lenaxia/ai-workflows). Ships PR #30: skip automation-bots in reusable pr-review.yml. Bot-authored PRs (release-please, dependabot, renovate, mergify, github-merge-queue) now skip the review workflow cleanly instead of failing with 'permission: none' before the AI can run. Also picks up the v0.2.8 TOKEN env workaround reverted (dead code — the opencode CLI handler at v1.18.16 has its own assertPermissions with no skip path; the legacy github/index.ts wrapper is not invoked when run via 'opencode github run').
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Commit reviewed: 31efbfc9e970abd94f467e047a029fb29d24d817
Code Review
Summary
Bumps three reusable-workflow refs and their version: inputs from v0.2.0 to v0.2.9. The version: input bump is correct, but the PR regresses every uses: pin from an immutable 40-char commit SHA to the movable @v0.2.9 tag and leaves the # v0.2.0 Renovate annotation stale on all three lines. Both are blocking.
Correctness
- ✓ The
version:input is bumped correctly on all three workflows (v0.2.0→v0.2.9). - ✗ Stale Renovate annotation. All three
uses:lines now read...@v0.2.9 # v0.2.0. The ref moved to v0.2.9 but the trailing comment still says v0.2.0, defeating the annotation's purpose (a human-readable pointer to the pinned version)..github/workflows/pr-review.yml:15.github/workflows/issue-opened.yml:15.github/workflows/ai-comment.yml:45
Architecture
N/A — this PR does not touch any container image. No apps/*/Dockerfile, docker-bake.hcl, or tests.yaml is changed. README-LLM.md Rules 1–4 (rootless, one process, base image, app structure) and the USER/ENTRYPOINT/CMD checklist do not apply to a CI reusable-workflow sync. Verified via git grep on the commit: the only changed paths are .github/workflows/{ai-comment,issue-opened,pr-review}.yml.
Tests
N/A — this PR modifies .github/workflows/*.yml reusable-workflow pins only. There is no tests.yaml, no apps/<name>/ change, and no image to build with docker buildx bake / validate with container-structure-test. Rule 0 (Test Before You Ship) governs container images and does not apply here.
Missing test cases
None identified — no new container functionality is introduced.
Required regression tests
- Defect (Security/Pinning): reusable-workflow
uses:references the movable tag@v0.2.9instead of the immutable commit SHA (see Security).- Test that would catch it: add a CI lint gate — e.g. a tiny
action-pin-checkjob, or a Renovategithub-actionsmanager with commit-SHA pin enforcement (the project already uses Renovate annotations fordocker-bake.hcl) — that fails anyuses:ref that is not a 40-char hex SHA. - Input/scenario: a PR introducing
uses: lenaxia/ai-workflows/.github/workflows/*.yml@v0.2.9(or any@<non-SHA>ref). - Expected: gate fails: "GitHub Actions reusable workflows must be pinned to a full commit SHA, not a tag."
- Actual: this PR passes because no such gate exists.
- Test that would catch it: add a CI lint gate — e.g. a tiny
- Defect (Correctness/Style): the
# v0.2.0annotation no longer matches the@v0.2.9ref.- Test that would catch it: the same gate can assert the trailing
# vX.Y.Zcomment equals the version the SHA resolves to (or at minimum equals the job'sversion:input). - Expected:
# v0.2.9. Actual:# v0.2.0.
- Test that would catch it: the same gate can assert the trailing
Security
✗ Moving-tag pin on reusable workflows (blocker). All three uses: refs were downgraded from an immutable SHA to a movable tag:
.github/workflows/pr-review.yml:15— was@374b026a6ff2e471f5aad733b58acb68c81e4b53, now@v0.2.9.github/workflows/issue-opened.yml:15— was@374b026a6ff2e471f5aad733b58acb68c81e4b53, now@v0.2.9.github/workflows/ai-comment.yml:45— was@374b026a6ff2e471f5aad733b58acb68c81e4b53, now@v0.2.9
A tag in lenaxia/ai-workflows can be force-moved or deleted by anyone with push access. If that repo or a maintainer account is compromised, @v0.2.9 could be silently re-pointed to malicious code that then runs here with secrets: inherit and the very broad permissions these files declare (id-token: write, contents: write, pull-requests: write, issues: write). SHA pinning makes the resolved code immutable and prevents exactly this; the prior SHA pins were deliberate. This is the same class of risk the project's Rule 3 ("Pin Everything … No latest tags") rejects for container images, and it is the explicit recommendation in GitHub's Actions security-hardening guide ("pin to the full length commit SHA … a tag can be moved").
Required fix: resolve v0.2.9 in lenaxia/ai-workflows to its commit SHA and pin each uses: to that SHA, updating the annotation to match:
uses: lenaxia/ai-workflows/.github/workflows/pr-review.yml@<full-40-char-sha-of-v0.2.9> # v0.2.9The repo's own Renovate setup produces SHA-pinned bumps for docker-bake.hcl; this manually-authored sync should follow the same convention it replaced.
Style
✗ Stale # v0.2.0 annotation on all three bumped lines (see Correctness). Once the SHA pin is restored, the comment must read # v0.2.9.
Verdict
REQUEST CHANGES — the version: input bump is correct, but the reusable-workflow refs must remain SHA-pinned (not the movable @v0.2.9 tag) and the # v0.2.0 annotations must be updated to # v0.2.9.
|
Review submitted on PR #254 as CHANGES_REQUESTED (blocking) against commit Two blocking findings:
The |
AI Assistant CommandsThe following commands are available on this issue/PR thread. Reply with one to
All commands are available to repository owners, members, and collaborators. |
1 participant
Manual sync from lenaxia/ai-workflows@v0.2.9.
propagate.yml computed this bump but could not open a cross-repo PR (AI_WORKFLOWS_PAT not set). PR opened manually.
What's in v0.2.9
permission: none.Diff
Bumps the three caller workflow files (
issue-opened.yml,pr-review.yml,ai-comment.yml) from their current pin to@v0.2.9. No source/prompt changes (those are forked/consumer-owned).