Re-pin dependabot-sync past the bot-author fix - #196
Conversation
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
This PR updates the pinned commit SHA for the reusable dependabot-sync-actions-comments workflow to pick up the upstream fix for bot author detection (app/<slug>), keeping this repo aligned with the organization workflow while preserving the existing (currently inactive in rollout) caller configuration.
Changes:
- Re-pin the called reusable workflow from
basecamp/.githubto the merge commit that includes basecamp/.github#12. - No behavioral changes in this repo’s workflow wiring besides the upstream workflow version bump.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
ff44ac1 to
0131179
Compare
basecamp/.github#12: gh reports bot PR creators as app/github-actions; the fail-closed re-verification refused auto-merge on the exercise's repair PR in basecamp-sdk. Workflow remains disabled in this repo until its rollout turn.
0131179 to
5458beb
Compare
basecamp/.github#12 fixed the
app/<slug>bot-author constant that basecamp-sdk's full-cycle exercise tripped (fail-closed, auto-merge refused as designed). Pin bump only; the workflow entry remains disabled in this repo until its turn in the one-at-a-time rollout.Summary by cubic
Re-pin the shared
dependabot-sync-actions-commentsworkflow to the version with the bot-author fix so PRs fromapp/github-actionsare handled correctly, and setpermissions.contentstowriteto allow auto-merge updates. The workflow remains disabled in this repo until its rollout turn.Written for commit 5458beb. Summary will update on new commits.