fix(ci): name the sha's real version on every action pin - #67
Closed
forkwright wants to merge 1 commit into
Closed
Conversation
A pinned action's comment is the only human-readable part of the pin, and one naming the wrong major answers the audit question confidently and wrongly -- worse than carrying no comment at all. This is dependabot's documented blind spot rather than a typo. It rewrites a version comment only when it can parse a PRECISE version out of the existing one, so a pin bumped across a major boundary keeps its stale comment while the sha moves underneath. That also means an imprecise `# v7` is a comment dependabot cannot maintain; naming `# v7.0.1` is what lets it stay correct. Every version here was resolved from the upstream tag list rather than inferred: actions/checkout@3d3c42e5aac5 -> v7.0.1 actions/stale@4391f3da665f -> v11.0.0 actions/upload-artifact@043fb46d1a93 -> v7.0.1 googleapis/release-please-action@45996ed1f6d0 -> v5.0.0 utilities/check-action-pin-comments.py reports 0 wrong-major comments across the fleet after this, down from 22.
forkwright added a commit
that referenced
this pull request
Aug 26, 2026
## Summary - replace Dioptron's trailer-only workflow with the first-party hybrid gate, including pull-request and push-to-main verification and the terminal `gate / gate` context - run every honest public docs-phase mechanism on untrailed changes: Python syntax, numbered-reference resolution, manifest completeness, and structural negative fixtures - keep `kanon lint --workflow`, README writing lint, and manifest-derived writing lint explicitly forge-only instead of claiming hosted GitHub ran a private binary - add the canonical Dependabot auto-merge caller and update contributor guidance to describe the hybrid contract ## Verification contract The PR itself is the first exact-head execution of the new hosted path. No local build, test, or gate command ran on Metis. The only local mechanical check was `git diff --check`. Dioptron has no Cargo workspace. The reusable's required command slots therefore carry real Python/document checks rather than vacuous `true` commands; the optional doctest slot is empty because it is structurally inapplicable. ## Collision inventory - PR #65 owns only `.github/workflows/release-pr-checks.yml`; this branch does not add or edit that file. - PR #67 changes one checkout-version comment inside the legacy gate implementation. This branch removes that checkout step with the legacy implementation, so #67's one-line path change becomes obsolete rather than being copied into dead machinery. - PRs #68 and #69 are path-disjoint. PR #69's worktree was not touched. ## Honest residual The shared Dependabot reusable currently requires Cargo security-check groups (`cargo deny`, `cargo audit`, and OSV) in addition to the terminal gate. A docs-only non-Cargo repository cannot emit those honestly. The new caller therefore fails closed for Dependabot until the reusable accepts a repository-specific verification contract; this PR does not manufacture vacuous Cargo jobs to make auto-merge appear functional. The shared hybrid workflow also installs Rust/nextest runner substrate unconditionally. That is harmless but unnecessary overhead for Dioptron's present non-Cargo phase and belongs in the reusable, not a local fork. Refs #67. Co-authored-by: forkwright <cody@forkwright.com>
forkwright
commented
Aug 26, 2026
OwnerAuthor
Re-verified immediately before closure: this PR's sole diff at |
forkwright added a commit
that referenced
this pull request
Aug 26, 2026
## Summary - remove the Dependabot caller that cannot function in a non-Cargo repository under the shared Cargo-only verification contract - make GitHub the authoritative repository, pull-request, review, CI, and merge surface in contributor guidance - describe `.kanon-ci.toml` as a supplementary local Kanon recipe, not a live forge pipeline or independent merge verifier ## Verification No local build, test suite, or Kanon gate ran on Metis. `git diff --check` passed on `acb496e15591e1e6899a04b8cf44e543b4268ad9`. This draft's public GitHub run is the first exact-head execution of the active verifier. ## Tracker and authority - Refs #70, whose merged caller and docs created the corrected surface. - Refs #72 for the operator-owned eventual `gate / gate` branch-protection requirement. This PR does not mutate repository authority. - Refs forkwright/.github#64 for a typed non-Cargo Dependabot verification profile. - Refs forkwright/.github#65 for a command-only hybrid-gate runner profile. ## Collision inventory - The branch is rooted at merged #70 commit `8b3fbe8b7c34355498a26f6870b6ac5235a29738` and does not reuse #70's deleted head branch. - PR #67's sole legacy-workflow comment change was re-verified as present in #70's replacement workflow, then #67 was closed with the exact supersession evidence. - Open PRs #65, #68, #69, and release PR #71 do not change these three paths. ## Honest residual `main` currently has zero required status contexts. Issue #72 deliberately sequences the operator-owned protection change after every surviving stale PR emits the genuine `gate / gate` context on its current head. Dependabot auto-merge remains absent in Dioptron until the shared reusable has a real non-Cargo contract. No vacuous Cargo jobs substitute for that missing mechanism. --------- Co-authored-by: forkwright <cody@forkwright.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finding
Pinned actions in this repo carry version comments that name the wrong major. A pin's comment is
the only human-readable part of it, and one naming the wrong major answers the audit question
confidently and wrongly — worse than carrying no comment at all.
Evidence
Every version below was resolved from the upstream tag list with
git ls-remote --tags, notinferred:
actions/checkout@3d3c42e5aac5v6actions/stale@4391f3da665fv10actions/upload-artifact@043fb46d1a93v4googleapis/release-please-action@45996ed1f6d0v4(Only the pins present in this repo are changed here.)
Why this matters
This is dependabot's documented blind spot rather than a typo. It rewrites a version comment only
when it can parse a precise version out of the existing one — so a pin bumped across a major
boundary keeps its stale comment while the SHA moves underneath, silently.
The same mechanism means an imprecise
# v7is a comment dependabot cannot maintain. Naming# v7.0.1is what lets it stay correct on the next bump.Desired correction
Name the SHA's real version.
utilities/check-action-pin-comments.pyreports 0 wrong-majorcomments across the whole fleet after this change, down from 22 across 8 repos.
Done when: the checker exits clean for this repo.
Verification note
This class needs no CI to verify — correctness is settled by the upstream tag list and confirmed by
the checker. Comment-only changes have no behavioural effect. Relevant because GitHub Actions is
recovering from a major outage (incident 2026-08-26T15:11:58Z) and private repos additionally have
no Actions minutes; I will not merge on an empty rollup either way.