Close the pinning loopholes: gate github_actions auto-merge, declare app secrets, pin internal action refs - #18
Merged
Conversation
1. Auto-merge admission gate: github_actions-ecosystem Dependabot PRs never auto-approve and never enter the AI upgrade queue — SHA-pin bumps of the org workflows now always get a human, which is what makes consumer pinning meaningful. Ecosystem string verified against fetch-metadata source (parsed from the dependabot/github_actions/* branch name). 2. TALIEISIN_TRIGGER_APP_ID/_PRIVATE_KEY declared (required:false) in auto-merge.yml workflow_call.secrets so callers can pass them by name instead of secrets:inherit; inherit callers unchanged. 3. Internal validated-push@main self-references (dependabot-upgrade x2, copilot-response x1) pinned to fea67b6 — the outer pin was mutable underneath while these resolved @main at run time. This repo's own dependabot bumps them (and after item 1, those bumps get reviewed). Claude-Session: https://claude.ai/code/session_012EuXdzh4NJzL5mxmsqRDzR
There was a problem hiding this comment.
Pull request overview
This PR hardens the org’s Dependabot automation for GitHub Actions by preventing unreviewed workflow/action bumps from auto-merging, making reusable-workflow SHA pinning meaningful, and removing @main resolution in internal action calls.
Changes:
- Gate Dependabot auto-merge (and the AI major-upgrade queue) for GitHub Actions ecosystem updates.
- Declare optional trigger-app secrets in
auto-merge.ymlso callers can pass them explicitly by name. - Pin internal
validated-pushaction references to a specific commit SHA instead of@main.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/dependabot-upgrade.yml | Pins internal validated-push action to a commit SHA to avoid runtime @main resolution. |
| .github/workflows/copilot-response.yml | Pins internal validated-push action to a commit SHA for deterministic behavior under pinned workflows. |
| .github/workflows/auto-merge.yml | Adds workflow_call secret declarations and gates auto-merge/AI-queue paths for GitHub Actions ecosystem bumps. |
Suppressed comments (4)
.github/workflows/auto-merge.yml:75
- Same ecosystem string mismatch here: if
package-ecosystemisgithub-actions, this condition won’t fire and the explanatory comment won’t be posted.
if: >-
steps.meta.outputs.package-ecosystem == 'github_actions' &&
(github.event.action == 'opened' || github.event.action == 'reopened')
.github/workflows/auto-merge.yml:99
- Same
package-ecosystemvalue mismatch (github_actionsvsgithub-actions) — this may incorrectly queue GitHub Actions bumps into the AI upgrade pipeline.
if: steps.meta.outputs.update-type == 'version-update:semver-major' && steps.meta.outputs.package-ecosystem != 'github_actions' && steps.trigger-token.outcome == 'success'
.github/workflows/auto-merge.yml:122
- Same ecosystem string mismatch here; fallback comment may be posted for GitHub Actions bumps if the output is
github-actions.
if: steps.meta.outputs.update-type == 'version-update:semver-major' && steps.meta.outputs.package-ecosystem != 'github_actions' && (github.event.action == 'opened' || github.event.action == 'reopened') && steps.trigger-token.outcome != 'success'
.github/workflows/auto-merge.yml:91
- This check uses
github_actions, but elsewhere in the repo the ecosystem is referenced asgithub-actions. If the metadata output isgithub-actions, this step will still run for workflow/action bumps.
if: steps.meta.outputs.update-type == 'version-update:semver-major' && steps.meta.outputs.package-ecosystem != 'github_actions' && (github.event.action == 'opened' || github.event.action == 'reopened')
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+63
to
+65
| if: >- | ||
| steps.meta.outputs.update-type != 'version-update:semver-major' && | ||
| steps.meta.outputs.package-ecosystem != 'github_actions' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan
https://claude.ai/code/session_012EuXdzh4NJzL5mxmsqRDzR