Sync Dependabot action pin comments via reusable workflow - #459
Conversation
Thin caller for basecamp/.github's dependabot-sync-actions-comments reusable workflow (basecamp/.github#8): after CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale pin version comments and pushes back behind a compare-and-swap lease, using the write deploy key scoped to this repo's dependabot-sync environment (deployment branches: main only). Replaces the push-triggered port withdrawn from #458: that lineage executed the freshly-bumped unreviewed checkout action with a write token, and GITHUB_TOKEN cannot push workflow-file changes at all.
github-actions
Bot
added
the
github-actions
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
Adds a thin GitHub Actions workflow in this repo that delegates to the SHA-pinned basecamp/.github reusable workflow to keep Dependabot github_actions pin comments (# vX.Y.Z) in sync by running trusted default-branch code and pushing fixes back with an environment-scoped deploy key.
Changes:
- Introduces
.github/workflows/dependabot-sync-actions-comments.ymlas a caller for thebasecamp/.githubreusable workflow. - Triggers on
workflow_runfor the repo’sTestworkflow (plusworkflow_dispatchfor manual runs) and forwards required inputs/permissions/secrets.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 1 file
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Review feedback: the job-level if only skips the job after the run is created; a trigger-level branches filter stops runs from being created for non-Dependabot branches at all. The if stays as defense-in-depth.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
.github/workflows/dependabot-sync-actions-comments.yml:35
- The job-level guard only checks
head_branchfor workflow_run events, so any non-PRTestrun on a Dependabot branch (manual dispatch, rerun by a human, etc.) will still invoke the reusable workflow and then get skipped internally. Tighten thisif:to match the reusable workflow’s gating (workflow_run.event == 'pull_request'andactor.login == 'dependabot[bot]') to avoid unnecessary reusable-workflow executions and reduce Actions noise.
if: >-
github.event_name == 'workflow_dispatch' ||
startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/')
basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not.
Thin caller for the
dependabot-sync-actions-commentsreusable workflow (basecamp/.github#8, merged as 95a9f7a2). After CI completes on a Dependabotgithub_actionsbranch, trusted default-branch code fixes any stale# vX.Y.Zpin comments — including compound ones with trailing# zizmor: ignore[...]annotations that Dependabot can't rewrite — and pushes back behind a compare-and-swap lease.This is the automation that was withdrawn from #458 after review: the push-triggered lineage executed the freshly-bumped (unreviewed) checkout action with a write token, and
GITHUB_TOKENcan't push workflow-file changes at all (openclaw-basecamp@54c96d3e). The reusable model runs only reviewed default-branch code, fetches the Dependabot head branch as data, and pushes with a write deploy key scoped to this repo'sdependabot-syncenvironment (deployment branches: main only). Environment + deploy key are already provisioned.#458 (comment fix + ignore restructure) remains complementary: bare version comments there let Dependabot itself maintain them as the first line of defense; this workflow is the backstop that catches what Dependabot can't rewrite.
Runtime validation: after merge, a
workflow_dispatchrun against a live Dependabot actions branch (basecamp-cli#566 is the standing candidate for the fleet) proves the full fix→guard→push→re-CI loop.Sibling callers: basecamp-cli#572, hey-cli#141, fizzy-cli#189, cli#51.
Summary by cubic
Adds a thin GitHub Actions caller for the reusable
dependabot-sync-actions-commentsto fix stale# vX.Y.Zpin comments ondependabot/github_actions/*branches after CI, then push via the repo’sdependabot-syncenvironment deploy key. Runs reviewed default-branch code only; the reusable workflow is re-pinned to the version that removed the CI-dispatch fallback and now verifies CI started on the pushed head.workflow_runofTestand manualworkflow_dispatch(branch,e2e), and filtersworkflow_runtodependabot/github_actions/**at the trigger (job-level guard remains).# zizmor: ignore[...]), guards pushes with a compare-and-swap lease, and verifies CI started on the pushed head instead of dispatching a fallback.secrets: inheritenables the environment-scoped deploy key to push.Written for commit e4acea2. Summary will update on new commits.