diff --git a/.github/workflows/auto-rebase.yml b/.github/workflows/auto-rebase.yml index 9c39634ad..52edeb235 100644 --- a/.github/workflows/auto-rebase.yml +++ b/.github/workflows/auto-rebase.yml @@ -38,5 +38,5 @@ jobs: permissions: contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) pull-requests: write # post comments on PRs - uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1 + uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v2 secrets: inherit diff --git a/.github/workflows/ci-failure-analyst.lock.yml b/.github/workflows/ci-failure-analyst.lock.yml index 38f8a9866..726019d29 100644 --- a/.github/workflows/ci-failure-analyst.lock.yml +++ b/.github/workflows/ci-failure-analyst.lock.yml @@ -30,6 +30,6 @@ jobs: if: >- github.event.check_run.conclusion == 'failure' && !startsWith(github.event.check_run.name, 'CI Failure Analyst') - uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@db60a41eb00b127f201c7294c529c7c599324e4e # main + uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@0ef7b6150516c4fa447700b4902e8ed406bcfb99 # main secrets: CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 845c32956..497f77c2e 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -35,5 +35,5 @@ jobs: permissions: contents: read pull-requests: read - uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1 + uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v2 secrets: inherit diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index f1173774d..72df1d0dd 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -30,4 +30,4 @@ permissions: jobs: dependency-audit: - uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1 + uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v2 diff --git a/.github/workflows/feature-ideation.yml b/.github/workflows/feature-ideation.yml index a137c9de4..6b5a69e92 100644 --- a/.github/workflows/feature-ideation.yml +++ b/.github/workflows/feature-ideation.yml @@ -64,7 +64,7 @@ jobs: discussions: write id-token: write actions: read - uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@d3d768dabb7f28cc63283cdfe48630da53700e50 # v1 + uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@376a4fcb1117444595e3e702fa450873d0e54310 # v2 with: # === CUSTOMISE THIS PER REPO — the only required edit === project_context: | diff --git a/.github/workflows/idea-enhancer.yml b/.github/workflows/idea-enhancer.yml index dc4265169..a88d44cd3 100644 --- a/.github/workflows/idea-enhancer.yml +++ b/.github/workflows/idea-enhancer.yml @@ -84,7 +84,7 @@ jobs: if: ${{ steps.gather.outputs.count != '0' }} env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133 + uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102 # v1.0.148 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/idea-triage.yml b/.github/workflows/idea-triage.yml index 6a4be437d..a2fd7dec0 100644 --- a/.github/workflows/idea-triage.yml +++ b/.github/workflows/idea-triage.yml @@ -71,7 +71,7 @@ jobs: - name: Rank ripeness and refresh the queue env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133 + uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102 # v1.0.148 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/initiative-planner.yml b/.github/workflows/initiative-planner.yml index cbe7fc9f6..38893eb05 100644 --- a/.github/workflows/initiative-planner.yml +++ b/.github/workflows/initiative-planner.yml @@ -89,7 +89,7 @@ jobs: id: bob env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133 + uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102 # v1.0.148 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # CRITICAL (same gotcha as feature-ideation): pass the workflow's diff --git a/.github/workflows/issue-triage-runner.yml b/.github/workflows/issue-triage-runner.yml index 89a9eb031..76095d318 100644 --- a/.github/workflows/issue-triage-runner.yml +++ b/.github/workflows/issue-triage-runner.yml @@ -19,7 +19,7 @@ jobs: result: ${{ steps.run.outputs.result }} skip: ${{ steps.run.outputs.skip }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -68,7 +68,7 @@ jobs: contents: read issues: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/repair-pr-approvals.yml b/.github/workflows/repair-pr-approvals.yml index d886ed40d..3edff67cf 100644 --- a/.github/workflows/repair-pr-approvals.yml +++ b/.github/workflows/repair-pr-approvals.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Repair PR approvals env: diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 7cc3119d7..dc44fc044 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -29,7 +29,7 @@ jobs: java-version: '21' - name: SonarCloud Scan if: ${{ env.SONAR_TOKEN != '' }} - uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0 + uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 with: args: > -Dsonar.scanner.javaExePath=${{ steps.setup_java.outputs.path }}/bin/java diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c20eb4b57..35ad3e4ea 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Run copilot_chat tests run: bash tests/test_copilot_chat.sh diff --git a/tests/dev-lead/integration/test_auto_rebase_stub.py b/tests/dev-lead/integration/test_auto_rebase_stub.py index 1b2f9c7fd..dca9abfa9 100644 --- a/tests/dev-lead/integration/test_auto_rebase_stub.py +++ b/tests/dev-lead/integration/test_auto_rebase_stub.py @@ -1,9 +1,9 @@ #!/usr/bin/env python3 -"""Validate that auto-rebase.yml uses the @v1 version tag, not a SHA. +"""Validate that auto-rebase.yml uses the @v2 version tag, not a SHA. AGENTS.md §"Release channel tags & the mutable-ref exception" exempts first-party reusable workflows from the SHA-pin standard. The correct reference for the -auto-rebase reusable is the versioned tag `@v1`, matching the canonical stub at +auto-rebase reusable is the versioned tag `@v2`, matching the canonical stub at standards/workflows/auto-rebase.yml in petry-projects/.github. Regression guard: a SHA-pinned reference is a compliance violation (issue #139). @@ -20,7 +20,7 @@ WORKFLOW = ".github/workflows/auto-rebase.yml" REUSABLE = "petry-projects/.github/.github/workflows/auto-rebase-reusable.yml" -EXPECTED_REF = "@v1" +EXPECTED_REF = "@v2" SHA_PATTERN = re.compile(r"@[0-9a-f]{40}\b") @@ -63,7 +63,7 @@ def main() -> int: failures.append( f" SHA-pinned: {ref!r}\n" f" Expected: '{REUSABLE}{EXPECTED_REF}'\n" - " Reason: first-party reusable workflows must use the @v1 version\n" + " Reason: first-party reusable workflows must use the @v2 version\n" " tag, not a SHA (AGENTS.md §Release channel tags)." ) elif not ref.endswith(EXPECTED_REF): diff --git a/tests/dev-lead/integration/test_dependency_audit_stub.py b/tests/dev-lead/integration/test_dependency_audit_stub.py index 87065a4af..0d075ed36 100644 --- a/tests/dev-lead/integration/test_dependency_audit_stub.py +++ b/tests/dev-lead/integration/test_dependency_audit_stub.py @@ -1,8 +1,8 @@ #!/usr/bin/env python3 -"""Validate that dependency-audit.yml is the canonical org stub pinned to @v1. +"""Validate that dependency-audit.yml is the canonical org stub pinned to @v2. The org standard requires dependency-audit.yml to be a thin caller stub that -delegates to the reusable at @v1 (not @v2 or any other ref). +delegates to the reusable at @v2 (not a SHA or any other ref). Standard: petry-projects/.github/standards/ci-standards.md#centralization-tiers Source of truth: petry-projects/.github/standards/workflows/dependency-audit.yml @@ -18,7 +18,7 @@ sys.exit(2) WORKFLOW = ".github/workflows/dependency-audit.yml" -EXPECTED_USES = "petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1" +EXPECTED_USES = "petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v2" def main() -> int: @@ -53,7 +53,7 @@ def main() -> int: print( f"FAIL: {WORKFLOW} job '{job_key}' uses '{uses}'\n" f" Expected: '{EXPECTED_USES}'\n" - f" Fix: replace the `uses:` value with the canonical @v1 ref." + f" Fix: replace the `uses:` value with the canonical @v2 ref." ) return 1