Uh oh!
There was an error while loading. Please reload this page.
release-train: develop -> staging - #161
Merged
Merged
Conversation
Pin every actions/* ref to the full 40-char commit SHA it currently resolves to, with a trailing exact-version comment (D10, RFC-BACKEND-1405). Behaviour-preserving: no version changes, only removal of silent tag mutation. tracebloc/* refs stay on @main by design; third-party refs were pinned under backend#1490. Part of tracebloc/backend#1491. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…91 sweep lands (backend#1492, D10) (#159) * sec(code-quality): whole-tree action-pin gate, advisory until the #1491 sweep lands (backend#1492, D10) Hand-pinning does not hold (#1446/#1449: a second unpinned call site of the SAME action merged cleanly while the pin PR was open). New default-on action-pins job: strict line grammar, comment-safe, whole-tree always; tracebloc/*@main allowed by Q3, 40-hex pins by D10, digest-pinned docker://, local ./ actions; expression refs are refused, not skipped (property 2). action-pins-soft-fail defaults true (format-soft-fail's migration shape) so armed repos do not redden before #1491 merges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(action-pins): judge tracebloc/* before SHA_PIN; build the expression marker from parts (Bugbot + actionlint, #159) A tracebloc ref frozen on a SHA is drift, not a pin - the owner check must come first. And actionlint validates expressions inside run: blocks, so the Python source must never contain a literal expression opener even in a string. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(action-pins): zero files scanned is a malfunction, not a pass; summary carries the full finding list (Bugbot round 2, #159) Any caller repo has at least one workflow (its own caller), so an empty glob means the checkout/cwd is wrong - fails even under soft-fail, which governs findings, never scan integrity. And the ten-annotation cap made a backlog repo show ten warnings and a bare count - the summary now lists every finding like the sibling jobs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
… On dev card (backend#1437) (#157) * fix(router): sibling-based merges get a visible label, not a stranded On dev card (backend#1437) The '*' fallthrough routed any merged PR with a non-integration base to On dev, where it stranded forever — the parent PR carries the content onward and nothing ever moves the sibling's card again (6 cards in the 2026-08-02 audit). Now: no column move, sibling-merge label instead, so the condition is visible to the weekly board pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(router+reconcile): sibling merges route to On dev WITH the label; writes hard-fail; reconcile mirrors the rule (Bugbot, #157) All three findings real: (1) a skipped Status write let the project's built-in Item-closed automation Cancel shipped-via-parent work - On dev + label is the non-terminal holding state; (2) || echo swallowed label write failures against the PROJECTS_KANBAN_TOKEN write rule - they fail the step now; (3) kanban-reconcile's membership add re-stranded siblings missed by auto-add - it now applies the identical rule + label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(router+reconcile): sibling merges route to On dev WITH the label; writes hard-fail; reconcile mirrors the rule (Bugbot, #157) All three findings real: (1) a skipped Status write let the project's built-in Item-closed automation Cancel shipped-via-parent work - On dev + label is the non-terminal holding state; (2) || echo swallowed label write failures against the PROJECTS_KANBAN_TOKEN write rule - they fail the step now; (3) kanban-reconcile's membership add re-stranded siblings missed by auto-add - it now applies the identical rule + label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(router+reconcile): status before label; dry runs never mutate (Bugbot round 2, #157) Label-before-status let a label failure skip the column write via the implicit success() condition, stranding the card in the built-in automation's Cancelled - exactly what round 1 fixed. Order flipped in both files. Reconcile's label write moves inside the wet path: dry runs classify (SIB flag) but mutate nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(router+reconcile): status before label; dry runs never mutate (Bugbot round 2, #157) Label-before-status let a label failure skip the column write via the implicit success() condition, stranding the card in the built-in automation's Cancelled - exactly what round 1 fixed. Order flipped in both files. Reconcile's label write moves inside the wet path: dry runs classify (SIB flag) but mutate nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(reconcile): reset the sibling flag per ITEM, not per merged-PR branch (Bugbot round 3, #157) SIB=0 lived inside the merged-PR else-branch, so an issue or open PR visited after a sibling inherited the flag and got mislabeled. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
LukasWodka
commented
Aug 6, 2026
ContributorAuthor
bugbot run |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit a8c6373. Configure here.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
LukasWodka
commented
Aug 6, 2026
ContributorAuthor
FR on staging → Ready for prod (staging FR sweep, 2026-08-06). Basis: promotion mirror PR — merged to staging via the fr-gated hop; carries no independent product behavior of its own. No product-behavior verification required for this class. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion by the release train (RFC-0008 D14). Head is the train-managed
release-train/to-stagingbranch (a mirror ofdevelop), so it never collides with a human PR. Merged only when the fr-gate is green.Note
Medium Risk
Changes affect org-wide CI and kanban automation (PAT label writes, project Status); mis-sync between router and reconcile could still strand cards, but scope is mostly pinning plus additive guards with soft-fail defaults.
Overview
Pins third-party GitHub Actions to commit SHAs across kanban, deploy, FR gate, caller-drift, and stale workflows (
checkout,setup-python,add-to-project,stale), matching org supply-chain policy (D10).Adds a whole-tree
action-pinsjob to the reusablecode-qualityworkflow: new callable inputs (action-pins,action-pins-soft-fail, both default on with soft-fail for fleet migration) scan every.github/workflows/*file for unpinneduses:refs, with allowed exceptions for local paths,tracebloc/*@main, 40-char SHAs, and digest-pinneddocker://images.Fixes kanban handling for PRs merged into sibling feature branches (not develop/staging/main): closure router keeps On dev (avoids mistaken Cancelled) and applies a
sibling-mergelabel after the Status write; weekly reconcile mirrors the same base-branch rule when backfilling missing cards, resets per-item sibling flags to avoid mislabeling issues, and applies the label only on non–dry-run adds.Reviewed by Cursor Bugbot for commit a8c6373. Bugbot is set up for automated code reviews on this repo. Configure here.