Re-pin dependabot-sync reusable workflow past the dispatch fallback - #190
Conversation
basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not.
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
This PR updates the SHA pin for the basecamp/.github reusable workflow used by Fizzy CLI’s Dependabot action-pin comment sync, aligning this repo with the upstream removal of the CI-dispatch fallback to avoid running freshly bumped action pins outside Dependabot’s restricted pull_request context.
Changes:
- Re-pins
basecamp/.github/.github/workflows/dependabot-sync-actions-comments.ymlto a newer commit SHA. - Keeps the existing trigger/inputs and forwards
ci-workflow-nameanddefault-branchunchanged.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
basecamp/.github#10 removed the CI-dispatch fallback (valid Codex P1 on fizzy-cli#189:
gh workflow run <wf> --ref <dependabot-branch>executes the branch's freshly-bumped, unreviewed action pins outside the Dependabot-restrictedpull_requestcontext). The reusable workflow now verifies CI started on the pushed head — which deploy-key pushes trigger normally — and warns a maintainer if not, never dispatching branch workflows. Pin bump only.Summary by cubic
Re-pinned the
basecamp/.githubdependabot-sync reusable workflow past the dispatch fallback removal. It now verifies CI started on the pushed head and warns instead of dispatching branch workflows, preventing unreviewed action pins from running outside Dependabot’s sandbox.Written for commit b7521bf. Summary will update on new commits.