From 1a1904ce4451b092bb803fcfb8efe972a61c80d3 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:06:23 -0700 Subject: [PATCH 1/5] ci: sync Dependabot action pin comments via reusable workflow Thin caller for basecamp/.github's dependabot-sync-actions-comments reusable workflow (basecamp/.github#8): after CI completes on a Dependabot github_actions branch, trusted default-branch code fixes any stale pin version comments and pushes back behind a compare-and-swap lease, using the write deploy key scoped to this repo's dependabot-sync environment (deployment branches: default branch only). Also adds workflow_dispatch to test.yml and security.yml so the reusable workflow's CI-dispatch fallback can re-run checks on the pushed head. --- .../dependabot-sync-actions-comments.yml | 46 +++++++++++++++++++ .github/workflows/security.yml | 1 + .github/workflows/test.yml | 1 + 3 files changed, 48 insertions(+) create mode 100644 .github/workflows/dependabot-sync-actions-comments.yml diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml new file mode 100644 index 0000000..93ec46c --- /dev/null +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -0,0 +1,46 @@ +name: Sync Dependabot action pin comments + +# Thin caller: all logic lives in basecamp/.github's reusable workflow — +# trusted default-branch code that fetches the Dependabot head branch as data +# only, rewrites stale `# vX.Y.Z` pin comments, and pushes back behind a +# compare-and-swap lease using the write deploy key scoped to this repo's +# dependabot-sync environment. + +on: + workflow_run: # zizmor: ignore[dangerous-triggers] -- only the SHA-pinned reusable workflow (reviewed default-branch code) executes; the Dependabot head branch is fetched as data, never executed + workflows: [CI] + types: [completed] + workflow_dispatch: + inputs: + branch: + description: Dependabot branch to sync (dependabot/github_actions/...) + required: true + type: string + e2e: + description: "E2E proof mode: expect a draft PR authored by the dispatcher on a dependabot/github_actions/e2e-proof-* branch" + required: false + default: false + type: boolean + +permissions: {} + +jobs: + sync: + # Cheap prefilter to avoid a skipped-run entry on every CI completion; + # the reusable workflow re-checks this and everything else. + if: >- + github.event_name == 'workflow_dispatch' || + startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/') + uses: basecamp/.github/.github/workflows/dependabot-sync-actions-comments.yml@95a9f7a2bd69c73cd2839eb4a27616e1651497e2 + with: + ci-workflow-name: CI + branch: ${{ inputs.branch || '' }} + e2e: ${{ inputs.e2e || false }} + permissions: + contents: read + actions: write + pull-requests: read + # The deploy key is scoped to this repo's dependabot-sync environment + # (deployment branches: default branch only); environment secrets cannot + # be forwarded explicitly to a reusable workflow, so inherit is required. + secrets: inherit # zizmor: ignore[secrets-inherit] -- see above; the called workflow is SHA-pinned and reads only SYNC_ACTIONS_DEPLOY_KEY, gated by the dependabot-sync environment diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 792dbff..7b7dc87 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -1,6 +1,7 @@ name: Security on: + workflow_dispatch: workflow_call: push: branches: [main] diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 62c0b7f..6590286 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,6 +1,7 @@ name: CI on: + workflow_dispatch: push: branches: [main] pull_request: From 7c44507f0362d2d7cdfc1e7bada06ded3ae90a24 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:19:15 -0700 Subject: [PATCH 2/5] ci: filter workflow_run to dependabot branches; give test.yml a unique name Review feedback (Copilot + Codex): a trigger-level branches filter stops workflow runs from being created for non-Dependabot branches (the job-level if only skips the job after the fact), and ci.yml and test.yml both being named CI made the workflow_run anchor fire twice per head and the ci-workflow-name detection ambiguous. test.yml becomes Test (matching basecamp-cli and cli); required status checks are job-name contexts (test, lint, security, race-check) so the rename does not affect the main-gate ruleset. Consolidating ci.yml vs test.yml overlap is left as a follow-up. --- .github/workflows/dependabot-sync-actions-comments.yml | 10 ++++++---- .github/workflows/test.yml | 2 +- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml index 93ec46c..e5c8b61 100644 --- a/.github/workflows/dependabot-sync-actions-comments.yml +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -8,8 +8,9 @@ name: Sync Dependabot action pin comments on: workflow_run: # zizmor: ignore[dangerous-triggers] -- only the SHA-pinned reusable workflow (reviewed default-branch code) executes; the Dependabot head branch is fetched as data, never executed - workflows: [CI] + workflows: [Test] types: [completed] + branches: ["dependabot/github_actions/**"] workflow_dispatch: inputs: branch: @@ -26,14 +27,15 @@ permissions: {} jobs: sync: - # Cheap prefilter to avoid a skipped-run entry on every CI completion; - # the reusable workflow re-checks this and everything else. + # Defense-in-depth behind the trigger-level branches filter (which stops + # runs from being created for other branches at all); the reusable + # workflow re-checks this and everything else. if: >- github.event_name == 'workflow_dispatch' || startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/') uses: basecamp/.github/.github/workflows/dependabot-sync-actions-comments.yml@95a9f7a2bd69c73cd2839eb4a27616e1651497e2 with: - ci-workflow-name: CI + ci-workflow-name: Test branch: ${{ inputs.branch || '' }} e2e: ${{ inputs.e2e || false }} permissions: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 6590286..2e276ce 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,4 +1,4 @@ -name: CI +name: Test on: workflow_dispatch: From 81087037c5cc088181539f3c597faa2359ad2085 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:28:07 -0700 Subject: [PATCH 3/5] deps: require Go 1.26.2 Clears the nine stdlib vulnerabilities govulncheck flags in go1.26.1 (GO-2026-4866 et al., all fixed in 1.26.2). The workflows resolve the toolchain from go.mod, so this moves CI and local builds together. --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 1e7992c..d14b55b 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/basecamp/hey-cli -go 1.26.1 +go 1.26.2 require ( charm.land/bubbles/v2 v2.1.0 From a0140f77468b93f659e4da55961aa95d4c9b98b3 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:28:52 -0700 Subject: [PATCH 4/5] ci: re-pin dependabot-sync reusable workflow past the dispatch fallback basecamp/.github#10 removed the CI-dispatch fallback (Codex P1 on fizzy-cli#189: dispatching branch workflows executes unreviewed action pins outside the Dependabot sandbox); the workflow now verifies CI started on the pushed head and warns a maintainer if not. --- .github/workflows/dependabot-sync-actions-comments.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml index e5c8b61..88c08e1 100644 --- a/.github/workflows/dependabot-sync-actions-comments.yml +++ b/.github/workflows/dependabot-sync-actions-comments.yml @@ -33,7 +33,7 @@ jobs: if: >- github.event_name == 'workflow_dispatch' || startsWith(github.event.workflow_run.head_branch, 'dependabot/github_actions/') - uses: basecamp/.github/.github/workflows/dependabot-sync-actions-comments.yml@95a9f7a2bd69c73cd2839eb4a27616e1651497e2 + uses: basecamp/.github/.github/workflows/dependabot-sync-actions-comments.yml@9ca40e3b2d6be769b370b7cee86e8448267c95d8 with: ci-workflow-name: Test branch: ${{ inputs.branch || '' }} From 46eb9e4939f126b56072f84f76c921b19a8cb470 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 27 Jul 2026 13:37:01 -0700 Subject: [PATCH 5/5] deps: require Go 1.26.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1.26.2 was not enough: govulncheck flags stdlib vulnerabilities fixed across 1.26.3–1.26.5 (GO-2026-5856 in crypto/tls et al.). 1.26.5 is the newest patch release, clearing all five remaining findings. --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index d14b55b..5e25231 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/basecamp/hey-cli -go 1.26.2 +go 1.26.5 require ( charm.land/bubbles/v2 v2.1.0