Re-pin dependabot-sync past the bot-author fix - #159
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the pinned commit SHA for the reusable dependabot-sync-actions-comments workflow from basecamp/.github, aligning this repo with the upstream bot-author fix referenced in the PR description while keeping the workflow definition otherwise unchanged.
Changes:
- Re-pins the reusable workflow reference in
.github/workflows/dependabot-sync-actions-comments.ymlto a newer commit SHA.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
016b732 to
3909c2e
Compare
basecamp/.github#12: gh reports bot PR creators as app/github-actions; the fail-closed re-verification refused auto-merge on the exercise's repair PR in basecamp-sdk. Workflow remains disabled in this repo until its rollout turn.
3909c2e to
80bd9b0
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
.github/workflows/dependabot-sync-actions-comments.yml:27
contentspermission was bumped towrite, which is a sensitive escalation. Since the called reusable workflow uses this only for PR auto-merge/merge operations, add a short inline comment here to document why write access is required (helps future reviewers verify this is intentional).
permissions:
contents: write
actions: write
basecamp/.github#12–#14 fixes discovered by the basecamp-sdk full-cycle exercise (each iteration fail-closed as designed):
app/<slug>bot-author constant, a bounded poll for the PR API to catch up with the lease push, andcontents: writeon the job token becauseenablePullRequestAutoMergeis a contents operation (the same grant the dependabot-auto-merge workflows carry — the token still cannot push workflow files; the repair branch push stays on the environment-scoped deploy key). So: pin bump plus that one deliberate permission raise in the caller block. The workflow entry stays disabled until this repo's rollout turn.