From 486e3927a0130b48fb8f62cf7f37eb5f46b076b9 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:07:05 -0700 Subject: [PATCH 1/3] ci: sync Dependabot action pin comments via reusable workflow Thin caller for basecamp/.github's dependabot-sync-actions-comments reusable workflow (basecamp/.github#8): after CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale pin version comments and pushes back behind a compare-and-swap lease, using the write deploy key scoped to this repo's dependabot-sync environment (deployment branches: default branch only). Also adds workflow_dispatch to test.yml and security.yml so the reusable workflow's CI-dispatch fallback can re-run checks on the pushed head. --- .../dependabot-sync-actions-comments.yml | 47 +++++++++++++++++++ .github/workflows/security.yml | 1 + .github/workflows/test.yml | 1 + 3 files changed, 49 insertions(+) create mode 100644 .github/workflows/dependabot-sync-actions-comments.yml diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml new file mode 100644 index 0000000..d77a89c --- /dev/null +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -0,0 +1,47 @@ +name: Sync Dependabot action pin comments + +# Thin caller: all logic lives in basecamp/.github's reusable workflow — +# trusted default-branch code that fetches the Dependabot head branch as data +# only, rewrites stale `# vX.Y.Z` pin comments, and pushes back behind a +# compare-and-swap lease using the write deploy key scoped to this repo's +# dependabot-sync environment. + +on: + workflow_run: # zizmor: ignore[dangerous-triggers] -- only the SHA-pinned reusable workflow (reviewed default-branch code) executes; the Dependabot head branch is fetched as data, never executed + workflows: [CI] + types: [completed] + workflow_dispatch: + inputs: + branch: + description: Dependabot branch to sync (dependabot/github_actions/...) + required: true + type: string + e2e: + description: "E2E proof mode: expect a draft PR authored by the dispatcher on a dependabot/github_actions/e2e-proof-* branch" + required: false + default: false + type: boolean + +permissions: {} + +jobs: + sync: + # Cheap prefilter to avoid a skipped-run entry on every CI completion; + # the reusable workflow re-checks this and everything else. + if: >- + github.event_name == 'workflow_dispatch' || + startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/') + uses: basecamp/.github/.github/workflows/dependabot-sync-actions-comments.yml@95a9f7a2bd69c73cd2839eb4a27616e1651497e2 + with: + ci-workflow-name: CI + default-branch: master + branch: ${{ inputs.branch || '' }} + e2e: ${{ inputs.e2e || false }} + permissions: + contents: read + actions: write + pull-requests: read + # The deploy key is scoped to this repo's dependabot-sync environment + # (deployment branches: default branch only); environment secrets cannot + # be forwarded explicitly to a reusable workflow, so inherit is required. + secrets: inherit # zizmor: ignore[secrets-inherit] -- see above; the called workflow is SHA-pinned and reads only SYNC_ACTIONS_DEPLOY_KEY, gated by the dependabot-sync environment diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d52c79d..f405c1f 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -1,6 +1,7 @@ name: Security on: + workflow_dispatch: workflow_call: push: branches: [master] diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index fc93761..ea8b4d6 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,6 +1,7 @@ name: CI on: + workflow_dispatch: push: branches: [master] pull_request: From 4d5e0fb9e214d2010acca302cb16e6371b1643c5 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:07:05 -0700 Subject: [PATCH 2/3] chore(actions): sync action pin comments One-time catch-up applying what the new sync workflow will maintain automatically: version comments on SHA-pinned uses lines whose trailing zizmor annotations prevented Dependabot from rewriting them. --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 28cc4ce..e378abb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,7 +41,7 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v6.4.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache with: go-version-file: go.mod From 447780fd3d6068deef03893d22ab04c1d95817b3 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:19:07 -0700 Subject: [PATCH 3/3] ci: filter workflow_run to dependabot branches at the trigger Review feedback: the job-level if only skips the job after the run is created; a trigger-level branches filter stops runs from being created for non-Dependabot branches at all. The if stays as defense-in-depth. --- .github/workflows/dependabot-sync-actions-comments.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml index d77a89c..261db07 100644 --- a/.github/workflows/dependabot-sync-actions-comments.yml +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -10,6 +10,7 @@ on: workflow_run: # zizmor: ignore[dangerous-triggers] -- only the SHA-pinned reusable workflow (reviewed default-branch code) executes; the Dependabot head branch is fetched as data, never executed workflows: [CI] types: [completed] + branches: ["dependabot/github_actions/**"] workflow_dispatch: inputs: branch: @@ -26,8 +27,9 @@ permissions: {} jobs: sync: - # Cheap prefilter to avoid a skipped-run entry on every CI completion; - # the reusable workflow re-checks this and everything else. + # Defense-in-depth behind the trigger-level branches filter (which stops + # runs from being created for other branches at all); the reusable + # workflow re-checks this and everything else. if: >- github.event_name == 'workflow_dispatch' || startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/')