From addd467ba385e239def512fb8165102db3b8cfb7 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:06:31 -0700 Subject: [PATCH 1/4] ci: sync Dependabot action pin comments via reusable workflow Thin caller for basecamp/.github's dependabot-sync-actions-comments reusable workflow (basecamp/.github#8): after CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale pin version comments and pushes back behind a compare-and-swap lease, using the write deploy key scoped to this repo's dependabot-sync environment (deployment branches: default branch only). --- .../dependabot-sync-actions-comments.yml | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/dependabot-sync-actions-comments.yml diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml new file mode 100644 index 0000000..2745075 --- /dev/null +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -0,0 +1,46 @@ +name: Sync Dependabot action pin comments + +# Thin caller: all logic lives in basecamp/.github's reusable workflow — +# trusted default-branch code that fetches the Dependabot head branch as data +# only, rewrites stale `# vX.Y.Z` pin comments, and pushes back behind a +# compare-and-swap lease using the write deploy key scoped to this repo's +# dependabot-sync environment. + +on: + workflow_run: # zizmor: ignore[dangerous-triggers] -- only the SHA-pinned reusable workflow (reviewed default-branch code) executes; the Dependabot head branch is fetched as data, never executed + workflows: [Test] + types: [completed] + workflow_dispatch: + inputs: + branch: + description: Dependabot branch to sync (dependabot/github_actions/...) + required: true + type: string + e2e: + description: "E2E proof mode: expect a draft PR authored by the dispatcher on a dependabot/github_actions/e2e-proof-* branch" + required: false + default: false + type: boolean + +permissions: {} + +jobs: + sync: + # Cheap prefilter to avoid a skipped-run entry on every CI completion; + # the reusable workflow re-checks this and everything else. + if: >- + github.event_name == 'workflow_dispatch' || + startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/') + uses: basecamp/.github/.github/workflows/dependabot-sync-actions-comments.yml@95a9f7a2bd69c73cd2839eb4a27616e1651497e2 + with: + ci-workflow-name: Test + branch: ${{ inputs.branch || '' }} + e2e: ${{ inputs.e2e || false }} + permissions: + contents: read + actions: write + pull-requests: read + # The deploy key is scoped to this repo's dependabot-sync environment + # (deployment branches: default branch only); environment secrets cannot + # be forwarded explicitly to a reusable workflow, so inherit is required. + secrets: inherit # zizmor: ignore[secrets-inherit] -- see above; the called workflow is SHA-pinned and reads only SYNC_ACTIONS_DEPLOY_KEY, gated by the dependabot-sync environment From d5641f5a076550127f3796f438608ba2bc2f955d Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:13:17 -0700 Subject: [PATCH 2/4] chore(actions): sync seed workflow pin comments One-time catch-up: the ref-version-mismatch audit is online, so upstream tag moves since the last CI run left 33 stale version comments in the seed templates (zizmor --fix=all, with the two cache-poisoning ignore annotations it clobbers restored by hand). Seed templates stay manually maintained; the new sync workflow covers only .github/workflows. --- seed/.github/workflows/ai-labeler.yml | 4 ++-- seed/.github/workflows/release.yml | 14 ++++++------ seed/.github/workflows/scorecard.yml | 2 +- seed/.github/workflows/security.yml | 14 ++++++------ seed/.github/workflows/test.yml | 32 +++++++++++++-------------- 5 files changed, 33 insertions(+), 33 deletions(-) diff --git a/seed/.github/workflows/ai-labeler.yml b/seed/.github/workflows/ai-labeler.yml index e460f65..d4668b2 100644 --- a/seed/.github/workflows/ai-labeler.yml +++ b/seed/.github/workflows/ai-labeler.yml @@ -19,7 +19,7 @@ jobs: models: read pull-requests: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -109,7 +109,7 @@ jobs: models: read pull-requests: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false diff --git a/seed/.github/workflows/release.yml b/seed/.github/workflows/release.yml index 014e7a4..90b2f31 100644 --- a/seed/.github/workflows/release.yml +++ b/seed/.github/workflows/release.yml @@ -31,7 +31,7 @@ jobs: APPNAME_NO_KEYRING: "1" # Uncomment for private module access: GOPRIVATE: github.com/basecamp/ steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -48,7 +48,7 @@ jobs: # repositories: ,homebrew-tap - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache with: go-version-file: 'go.mod' @@ -59,7 +59,7 @@ jobs: run: git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/" - name: Install golangci-lint - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9 + uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 with: version: v2.9.0 install-only: true @@ -134,7 +134,7 @@ jobs: HAS_AUR_KEY: ${{ secrets.AUR_SSH_KEY && 'true' || '' }} # Uncomment for private module access: GOPRIVATE: github.com/basecamp/ steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -151,7 +151,7 @@ jobs: # repositories: ,homebrew-tap - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache with: go-version-file: 'go.mod' @@ -289,7 +289,7 @@ jobs: MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} - name: Install GoReleaser - uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7 + uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0 with: distribution: goreleaser version: 'v2.14.1' @@ -350,7 +350,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false diff --git a/seed/.github/workflows/scorecard.yml b/seed/.github/workflows/scorecard.yml index 95f9ea6..49ee25b 100644 --- a/seed/.github/workflows/scorecard.yml +++ b/seed/.github/workflows/scorecard.yml @@ -17,7 +17,7 @@ jobs: id-token: write contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false diff --git a/seed/.github/workflows/security.yml b/seed/.github/workflows/security.yml index ce41ad6..e5af8f0 100644 --- a/seed/.github/workflows/security.yml +++ b/seed/.github/workflows/security.yml @@ -23,7 +23,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -44,7 +44,7 @@ jobs: security-events: write steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -75,7 +75,7 @@ jobs: security-events: write steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -90,7 +90,7 @@ jobs: owner: basecamp - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' @@ -123,7 +123,7 @@ jobs: if: github.event_name == 'pull_request' continue-on-error: true # Requires GitHub Advanced Security (not available on all plans) steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803 # v4.8.3 @@ -135,7 +135,7 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -150,7 +150,7 @@ jobs: owner: basecamp - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' diff --git a/seed/.github/workflows/test.yml b/seed/.github/workflows/test.yml index c3b8f5a..b234cc3 100644 --- a/seed/.github/workflows/test.yml +++ b/seed/.github/workflows/test.yml @@ -19,7 +19,7 @@ jobs: APPNAME_NO_KEYRING: "1" # Uncomment for private module access: GOPRIVATE: github.com/basecamp/ steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -35,7 +35,7 @@ jobs: # repositories: - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' @@ -66,7 +66,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -81,7 +81,7 @@ jobs: owner: basecamp - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' @@ -92,7 +92,7 @@ jobs: run: git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/" - name: Run golangci-lint - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9 + uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 with: version: v2.9.0 @@ -102,7 +102,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -116,7 +116,7 @@ jobs: owner: basecamp - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' @@ -142,7 +142,7 @@ jobs: APPNAME_NO_KEYRING: "1" # Uncomment for private module access: GOPRIVATE: github.com/basecamp/ steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -156,7 +156,7 @@ jobs: owner: basecamp - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' @@ -178,7 +178,7 @@ jobs: APPNAME_NO_KEYRING: "1" # Uncomment for private module access: GOPRIVATE: github.com/basecamp/ steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false @@ -192,7 +192,7 @@ jobs: owner: basecamp - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' @@ -227,7 +227,7 @@ jobs: APPNAME_NO_KEYRING: "1" # Uncomment for private module access: GOPRIVATE: github.com/basecamp/ steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -242,7 +242,7 @@ jobs: owner: basecamp - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' @@ -285,7 +285,7 @@ jobs: APPNAME_NO_KEYRING: "1" # Uncomment for private module access: GOPRIVATE: github.com/basecamp/ steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 2 persist-credentials: false @@ -301,7 +301,7 @@ jobs: - name: Check for benchmark-relevant changes id: filter - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3 + uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2 with: filters: | bench: @@ -311,7 +311,7 @@ jobs: - name: Set up Go if: steps.filter.outputs.bench == 'true' - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 with: go-version-file: 'go.mod' From d3855c55b42f985059fa5bc5d884b4696f03e015 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:13:17 -0700 Subject: [PATCH 3/4] deps: bump golang.org/x/sys to v0.44.0 Clears CVE-2026-39824 (integer overflow in NewNTUnicodeString, golang.org/x/sys/windows) flagged by the Trivy gate. Indirect dependency; go build ./... verified. --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 359b1bb..db77c4a 100644 --- a/go.mod +++ b/go.mod @@ -15,6 +15,6 @@ require ( github.com/godbus/dbus/v5 v5.2.2 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect - golang.org/x/sys v0.27.0 // indirect + golang.org/x/sys v0.44.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index c67fd88..8c91c78 100644 --- a/go.sum +++ b/go.sum @@ -22,8 +22,8 @@ github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs= github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s= -golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ= +golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= From 515ffcadebfcee646119aa5d6ea4df862b73bf05 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:19:11 -0700 Subject: [PATCH 4/4] ci: filter workflow_run to dependabot branches at the trigger Review feedback: the job-level if only skips the job after the run is created; a trigger-level branches filter stops runs from being created for non-Dependabot branches at all. The if stays as defense-in-depth. --- .github/workflows/dependabot-sync-actions-comments.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml index 2745075..e5c8b61 100644 --- a/.github/workflows/dependabot-sync-actions-comments.yml +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -10,6 +10,7 @@ on: workflow_run: # zizmor: ignore[dangerous-triggers] -- only the SHA-pinned reusable workflow (reviewed default-branch code) executes; the Dependabot head branch is fetched as data, never executed workflows: [Test] types: [completed] + branches: ["dependabot/github_actions/**"] workflow_dispatch: inputs: branch: @@ -26,8 +27,9 @@ permissions: {} jobs: sync: - # Cheap prefilter to avoid a skipped-run entry on every CI completion; - # the reusable workflow re-checks this and everything else. + # Defense-in-depth behind the trigger-level branches filter (which stops + # runs from being created for other branches at all); the reusable + # workflow re-checks this and everything else. if: >- github.event_name == 'workflow_dispatch' || startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/')