From 30d09b15f37fafdee15472fdc6e3e27ef52949fb Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:08:18 -0700 Subject: [PATCH 1/3] CI: sync Dependabot action pin comments via reusable workflow Thin caller for basecamp/.github's dependabot-sync-actions-comments reusable workflow (basecamp/.github#8): after CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale pin version comments and pushes back behind a compare-and-swap lease, using the write deploy key scoped to this repo's dependabot-sync environment (deployment branches: main only). Replaces the push-triggered port withdrawn from #458: that lineage executed the freshly-bumped unreviewed checkout action with a write token, and GITHUB_TOKEN cannot push workflow-file changes at all. --- .../dependabot-sync-actions-comments.yml | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/dependabot-sync-actions-comments.yml diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml new file mode 100644 index 000000000..2745075e6 --- /dev/null +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -0,0 +1,46 @@ +name: Sync Dependabot action pin comments + +# Thin caller: all logic lives in basecamp/.github's reusable workflow — +# trusted default-branch code that fetches the Dependabot head branch as data +# only, rewrites stale `# vX.Y.Z` pin comments, and pushes back behind a +# compare-and-swap lease using the write deploy key scoped to this repo's +# dependabot-sync environment. + +on: + workflow_run: # zizmor: ignore[dangerous-triggers] -- only the SHA-pinned reusable workflow (reviewed default-branch code) executes; the Dependabot head branch is fetched as data, never executed + workflows: [Test] + types: [completed] + workflow_dispatch: + inputs: + branch: + description: Dependabot branch to sync (dependabot/github_actions/...) + required: true + type: string + e2e: + description: "E2E proof mode: expect a draft PR authored by the dispatcher on a dependabot/github_actions/e2e-proof-* branch" + required: false + default: false + type: boolean + +permissions: {} + +jobs: + sync: + # Cheap prefilter to avoid a skipped-run entry on every CI completion; + # the reusable workflow re-checks this and everything else. + if: >- + github.event_name == 'workflow_dispatch' || + startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/') + uses: basecamp/.github/.github/workflows/dependabot-sync-actions-comments.yml@95a9f7a2bd69c73cd2839eb4a27616e1651497e2 + with: + ci-workflow-name: Test + branch: ${{ inputs.branch || '' }} + e2e: ${{ inputs.e2e || false }} + permissions: + contents: read + actions: write + pull-requests: read + # The deploy key is scoped to this repo's dependabot-sync environment + # (deployment branches: default branch only); environment secrets cannot + # be forwarded explicitly to a reusable workflow, so inherit is required. + secrets: inherit # zizmor: ignore[secrets-inherit] -- see above; the called workflow is SHA-pinned and reads only SYNC_ACTIONS_DEPLOY_KEY, gated by the dependabot-sync environment From e0707b02c85f158e21c15ad3e34c66f334bccc71 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:19:23 -0700 Subject: [PATCH 2/3] CI: filter workflow_run to dependabot branches at the trigger Review feedback: the job-level if only skips the job after the run is created; a trigger-level branches filter stops runs from being created for non-Dependabot branches at all. The if stays as defense-in-depth. --- .github/workflows/dependabot-sync-actions-comments.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml index 2745075e6..e5c8b6124 100644 --- a/.github/workflows/dependabot-sync-actions-comments.yml +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -10,6 +10,7 @@ on: workflow_run: # zizmor: ignore[dangerous-triggers] -- only the SHA-pinned reusable workflow (reviewed default-branch code) executes; the Dependabot head branch is fetched as data, never executed workflows: [Test] types: [completed] + branches: ["dependabot/github_actions/**"] workflow_dispatch: inputs: branch: @@ -26,8 +27,9 @@ permissions: {} jobs: sync: - # Cheap prefilter to avoid a skipped-run entry on every CI completion; - # the reusable workflow re-checks this and everything else. + # Defense-in-depth behind the trigger-level branches filter (which stops + # runs from being created for other branches at all); the reusable + # workflow re-checks this and everything else. if: >- github.event_name == 'workflow_dispatch' || startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/') From e4acea254ec66c30bb1607218c18563a8ae7b5de Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:28:49 -0700 Subject: [PATCH 3/3] CI: re-pin dependabot-sync reusable workflow past the dispatch fallback basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not. --- .github/workflows/dependabot-sync-actions-comments.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml index e5c8b6124..88c08e1b5 100644 --- a/.github/workflows/dependabot-sync-actions-comments.yml +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -33,7 +33,7 @@ jobs: if: >- github.event_name == 'workflow_dispatch' || startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/') - uses: basecamp/.github/.github/workflows/dependabot-sync-actions-comments.yml@95a9f7a2bd69c73cd2839eb4a27616e1651497e2 + uses: basecamp/.github/.github/workflows/dependabot-sync-actions-comments.yml@9ca40e3b2d6be769b370b7cee86e8448267c95d8 with: ci-workflow-name: Test branch: ${{ inputs.branch || '' }}