ci: float reusable-workflow refs so fleet fixes can reach this repo - #36
Merged
Merged
Conversation
Replaces immutable pins on smartwatermelon/github-workflows reusable workflows with the floating tags they already correspond to: @v3.2.1 / @v3.1.1 / @688e0288... -> @V3 @054f2f7f... -> @dependabot-auto-merge-v2 No behaviour change at merge time for auto-merge: @dependabot-auto-merge-v2 points at 054f2f7f today, so that ref is byte-equivalent. Refs moving to @V3 go from 688e0288 to e6e2643, which is two claude-code-action SHA bumps (1.0.193 -> 1.0.219) with no logic change; both bumped steps already carry continue-on-error: true. That move was exercised green on smartwatermelon/swift-progress-indicator#31 and again on nightowlstudiollc/financial-agent#187, both through claude-blocking-review.yml. claude-assistant.yml takes the same bump but only fires on @claude mentions, so it is unexercised -- same action, same bump, low risk, but not verified. Why this matters: an immutable ref cannot carry a fix published after it was cut. When GHSA-8q5r-mmjf-575q was patched upstream, the fix reached consumers by repointing one tag, and the repos pinned to an exact version silently received nothing. Floating first-party refs is sanctioned policy -- github-workflows/zizmor.yml:45-54 grants smartwatermelon/github-workflows/*: ref-pin while keeping "*": hash-pin for third-party actions. Any stale trailing comment is dropped with the pin it annotated. A comment is not a pin, and several had already drifted from the SHA beside them. Verified: zizmor clean on every changed file against the fleet policy. Claude-Session: https://claude.ai/code/session_01PTUKVrdfDTU3ZH149e9pTY
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces immutable pins on
smartwatermelon/github-workflowsreusable workflows with the floating tags they already correspond to:@v3.2.1/@v3.1.1/@688e0288…@v3@054f2f7f…@dependabot-auto-merge-v2Behaviour change
Auto-merge: none.
@dependabot-auto-merge-v2points at054f2f7ftoday — byte-equivalent.Refs moving to
@v3:688e0288→e6e2643, which is twoclaude-code-actionSHA bumps (1.0.193 → 1.0.219) and no logic change. Both bumped steps already carrycontinue-on-error: true. Exercised green onsmartwatermelon/swift-progress-indicator#31and again onnightowlstudiollc/financial-agent#187, both throughclaude-blocking-review.yml.claude-assistant.ymltakes the same bump but only fires on@claudementions, so it is unexercised — same action, same bump, low risk, but not verified.Why
An immutable ref cannot carry a fix published after it was cut. When GHSA-8q5r-mmjf-575q was patched upstream, the fix reached consumers by repointing one tag; repos pinned to an exact version silently received nothing.
Floating first-party refs is sanctioned policy:
github-workflows/zizmor.yml:45-54grantssmartwatermelon/github-workflows/*: ref-pinwhile keeping"*": hash-pinfor third-party actions. The pre-commit gap that pushed some repos into raw SHA pins is fixed upstream intwistedmelonman/dotfiles#344.Stale comments
Any trailing
# v3-style comment is dropped with the pin it annotated. A comment is not a pin, and several had already drifted from the SHA beside them.Verification
zizmorclean on every changed file against the fleet policy.Part of Task 1.1c (16 repos, 25 refs). Plan:
/Users/andrewrich/Developer/dev-env/.claude/scratch/phase-1.1-rescope.mdhttps://claude.ai/code/session_01PTUKVrdfDTU3ZH149e9pTY