Skip to content

Non-blocking review findings from PR #36 (1) #37

Description

@twistedmelonman

Non-blocking concerns raised while reviewing PR #36 (ci: float reusable-workflow refs so fleet fixes can reach this repo).

None of these blocked the merge. They are batched into one issue so a
review's findings stay one unit of attention rather than 1 separate
tracking issues; tick items off as they are addressed, and close this issue
when the list is done or the remaining items are judged not worth doing.

  • Floating reusable-workflow ref to a major tag trades pinning for fleet-fix reach (diff review (no reviewer raised this; recorded as supply-chain context), .github/workflows/claude-blocking-review.yml:15)
    The reusable workflow ref moves from the exact tag @v3.2.1 to the moving major tag @v3, which is the stated intent of the PR — letting fleet-wide fixes reach this repo without a per-repo bump. The tradeoff is that a mutable tag in a first-party smartwatermelon/github-workflows repo is no longer reproducible, which sits in tension with the SHA-pinning work done for third-party actions in 5d79288. This is a deliberate policy choice for a trusted first-party repo, not a defect; worth recording so the pinning posture stays consistent if the org's supply-chain rules tighten later.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    tech-debtTechnical debt to address

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions