From e76cf076e704445698e9dd7444d8da47babe215e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 13 Jun 2026 19:52:29 +0000 Subject: [PATCH 1/2] chore(deps): bump the actions group across 1 directory with 8 updates Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `6.0.3` | | [petry-projects/.github/.github/workflows/auto-rebase-reusable.yml](https://github.com/petry-projects/.github) | `1` | `2` | | [petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml](https://github.com/petry-projects/.github-private) | `db60a41eb00b127f201c7294c529c7c599324e4e` | `0ef7b6150516c4fa447700b4902e8ed406bcfb99` | | [petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml](https://github.com/petry-projects/.github) | `1` | `2` | | [petry-projects/.github/.github/workflows/dependency-audit-reusable.yml](https://github.com/petry-projects/.github) | `1` | `2` | | [petry-projects/.github/.github/workflows/feature-ideation-reusable.yml](https://github.com/petry-projects/.github) | `1` | `2` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.133` | `1.0.148` | | [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) | `8.1.0` | `8.2.0` | Updates `actions/checkout` from 6.0.2 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6.0.2...df4cb1c069e1874edd31b4311f1884172cec0e10) Updates `petry-projects/.github/.github/workflows/auto-rebase-reusable.yml` from 1 to 2 - [Commits](https://github.com/petry-projects/.github/compare/v1...v2) Updates `petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml` from db60a41eb00b127f201c7294c529c7c599324e4e to 0ef7b6150516c4fa447700b4902e8ed406bcfb99 - [Commits](https://github.com/petry-projects/.github-private/compare/db60a41eb00b127f201c7294c529c7c599324e4e...0ef7b6150516c4fa447700b4902e8ed406bcfb99) Updates `petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml` from 1 to 2 - [Commits](https://github.com/petry-projects/.github/compare/v1...v2) Updates `petry-projects/.github/.github/workflows/dependency-audit-reusable.yml` from 1 to 2 - [Commits](https://github.com/petry-projects/.github/compare/v1...v2) Updates `petry-projects/.github/.github/workflows/feature-ideation-reusable.yml` from 1 to 2 - [Commits](https://github.com/petry-projects/.github/compare/d3d768dabb7f28cc63283cdfe48630da53700e50...376a4fcb1117444595e3e702fa450873d0e54310) Updates `anthropics/claude-code-action` from 1.0.133 to 1.0.148 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251...d5726de019ec4498aa667642bc3a80fca83aa102) Updates `SonarSource/sonarqube-scan-action` from 8.1.0 to 8.2.0 - [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases) - [Commits](https://github.com/sonarsource/sonarqube-scan-action/compare/7006c4492b2e0ee0f816d36501671557c97f5995...713881670b6b3676cda39549040e2d88c70d582e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.148 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml dependency-version: 0ef7b6150516c4fa447700b4902e8ed406bcfb99 dependency-type: direct:production dependency-group: actions - dependency-name: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: SonarSource/sonarqube-scan-action dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/auto-rebase.yml | 2 +- .github/workflows/ci-failure-analyst.lock.yml | 2 +- .github/workflows/dependabot-automerge.yml | 2 +- .github/workflows/dependency-audit.yml | 2 +- .github/workflows/feature-ideation.yml | 2 +- .github/workflows/idea-enhancer.yml | 2 +- .github/workflows/idea-triage.yml | 2 +- .github/workflows/initiative-planner.yml | 2 +- .github/workflows/issue-triage-runner.yml | 4 ++-- .github/workflows/repair-pr-approvals.yml | 2 +- .github/workflows/sonarcloud.yml | 2 +- .github/workflows/test.yml | 2 +- 12 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/auto-rebase.yml b/.github/workflows/auto-rebase.yml index 9c39634ad..52edeb235 100644 --- a/.github/workflows/auto-rebase.yml +++ b/.github/workflows/auto-rebase.yml @@ -38,5 +38,5 @@ jobs: permissions: contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) pull-requests: write # post comments on PRs - uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1 + uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v2 secrets: inherit diff --git a/.github/workflows/ci-failure-analyst.lock.yml b/.github/workflows/ci-failure-analyst.lock.yml index 38f8a9866..726019d29 100644 --- a/.github/workflows/ci-failure-analyst.lock.yml +++ b/.github/workflows/ci-failure-analyst.lock.yml @@ -30,6 +30,6 @@ jobs: if: >- github.event.check_run.conclusion == 'failure' && !startsWith(github.event.check_run.name, 'CI Failure Analyst') - uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@db60a41eb00b127f201c7294c529c7c599324e4e # main + uses: petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml@0ef7b6150516c4fa447700b4902e8ed406bcfb99 # main secrets: CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 845c32956..497f77c2e 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -35,5 +35,5 @@ jobs: permissions: contents: read pull-requests: read - uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1 + uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v2 secrets: inherit diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index f1173774d..72df1d0dd 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -30,4 +30,4 @@ permissions: jobs: dependency-audit: - uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1 + uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v2 diff --git a/.github/workflows/feature-ideation.yml b/.github/workflows/feature-ideation.yml index a137c9de4..6b5a69e92 100644 --- a/.github/workflows/feature-ideation.yml +++ b/.github/workflows/feature-ideation.yml @@ -64,7 +64,7 @@ jobs: discussions: write id-token: write actions: read - uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@d3d768dabb7f28cc63283cdfe48630da53700e50 # v1 + uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@376a4fcb1117444595e3e702fa450873d0e54310 # v2 with: # === CUSTOMISE THIS PER REPO — the only required edit === project_context: | diff --git a/.github/workflows/idea-enhancer.yml b/.github/workflows/idea-enhancer.yml index dc4265169..a88d44cd3 100644 --- a/.github/workflows/idea-enhancer.yml +++ b/.github/workflows/idea-enhancer.yml @@ -84,7 +84,7 @@ jobs: if: ${{ steps.gather.outputs.count != '0' }} env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133 + uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102 # v1.0.148 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/idea-triage.yml b/.github/workflows/idea-triage.yml index 6a4be437d..a2fd7dec0 100644 --- a/.github/workflows/idea-triage.yml +++ b/.github/workflows/idea-triage.yml @@ -71,7 +71,7 @@ jobs: - name: Rank ripeness and refresh the queue env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133 + uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102 # v1.0.148 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/initiative-planner.yml b/.github/workflows/initiative-planner.yml index cbe7fc9f6..38893eb05 100644 --- a/.github/workflows/initiative-planner.yml +++ b/.github/workflows/initiative-planner.yml @@ -89,7 +89,7 @@ jobs: id: bob env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133 + uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102 # v1.0.148 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # CRITICAL (same gotcha as feature-ideation): pass the workflow's diff --git a/.github/workflows/issue-triage-runner.yml b/.github/workflows/issue-triage-runner.yml index 89a9eb031..76095d318 100644 --- a/.github/workflows/issue-triage-runner.yml +++ b/.github/workflows/issue-triage-runner.yml @@ -19,7 +19,7 @@ jobs: result: ${{ steps.run.outputs.result }} skip: ${{ steps.run.outputs.skip }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -68,7 +68,7 @@ jobs: contents: read issues: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/repair-pr-approvals.yml b/.github/workflows/repair-pr-approvals.yml index d886ed40d..3edff67cf 100644 --- a/.github/workflows/repair-pr-approvals.yml +++ b/.github/workflows/repair-pr-approvals.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Repair PR approvals env: diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 7cc3119d7..dc44fc044 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -29,7 +29,7 @@ jobs: java-version: '21' - name: SonarCloud Scan if: ${{ env.SONAR_TOKEN != '' }} - uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0 + uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0 with: args: > -Dsonar.scanner.javaExePath=${{ steps.setup_java.outputs.path }}/bin/java diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c20eb4b57..35ad3e4ea 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -13,7 +13,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Run copilot_chat tests run: bash tests/test_copilot_chat.sh From 2aa764a68696c9c8e2b64fa0e0f4dbb68d32416b Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 13 Jun 2026 20:55:52 +0000 Subject: [PATCH 2/2] test: pin auto-rebase & dependency-audit stub tests to @v2 The Dependabot actions-group bump upgrades the first-party reusables (auto-rebase, dependabot-automerge, dependency-audit) from @v1 to @v2. test_auto_rebase_stub.py and test_dependency_audit_stub.py hard-assert @v1, so they failed against the bumped caller stubs. Update both to expect @v2 so the structure guards match the upgraded refs. https://claude.ai/code/session_01BTcE5pAvrmNqkatFUTAetF --- tests/dev-lead/integration/test_auto_rebase_stub.py | 8 ++++---- tests/dev-lead/integration/test_dependency_audit_stub.py | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/tests/dev-lead/integration/test_auto_rebase_stub.py b/tests/dev-lead/integration/test_auto_rebase_stub.py index 1b2f9c7fd..dca9abfa9 100644 --- a/tests/dev-lead/integration/test_auto_rebase_stub.py +++ b/tests/dev-lead/integration/test_auto_rebase_stub.py @@ -1,9 +1,9 @@ #!/usr/bin/env python3 -"""Validate that auto-rebase.yml uses the @v1 version tag, not a SHA. +"""Validate that auto-rebase.yml uses the @v2 version tag, not a SHA. AGENTS.md §"Release channel tags & the mutable-ref exception" exempts first-party reusable workflows from the SHA-pin standard. The correct reference for the -auto-rebase reusable is the versioned tag `@v1`, matching the canonical stub at +auto-rebase reusable is the versioned tag `@v2`, matching the canonical stub at standards/workflows/auto-rebase.yml in petry-projects/.github. Regression guard: a SHA-pinned reference is a compliance violation (issue #139). @@ -20,7 +20,7 @@ WORKFLOW = ".github/workflows/auto-rebase.yml" REUSABLE = "petry-projects/.github/.github/workflows/auto-rebase-reusable.yml" -EXPECTED_REF = "@v1" +EXPECTED_REF = "@v2" SHA_PATTERN = re.compile(r"@[0-9a-f]{40}\b") @@ -63,7 +63,7 @@ def main() -> int: failures.append( f" SHA-pinned: {ref!r}\n" f" Expected: '{REUSABLE}{EXPECTED_REF}'\n" - " Reason: first-party reusable workflows must use the @v1 version\n" + " Reason: first-party reusable workflows must use the @v2 version\n" " tag, not a SHA (AGENTS.md §Release channel tags)." ) elif not ref.endswith(EXPECTED_REF): diff --git a/tests/dev-lead/integration/test_dependency_audit_stub.py b/tests/dev-lead/integration/test_dependency_audit_stub.py index 87065a4af..0d075ed36 100644 --- a/tests/dev-lead/integration/test_dependency_audit_stub.py +++ b/tests/dev-lead/integration/test_dependency_audit_stub.py @@ -1,8 +1,8 @@ #!/usr/bin/env python3 -"""Validate that dependency-audit.yml is the canonical org stub pinned to @v1. +"""Validate that dependency-audit.yml is the canonical org stub pinned to @v2. The org standard requires dependency-audit.yml to be a thin caller stub that -delegates to the reusable at @v1 (not @v2 or any other ref). +delegates to the reusable at @v2 (not a SHA or any other ref). Standard: petry-projects/.github/standards/ci-standards.md#centralization-tiers Source of truth: petry-projects/.github/standards/workflows/dependency-audit.yml @@ -18,7 +18,7 @@ sys.exit(2) WORKFLOW = ".github/workflows/dependency-audit.yml" -EXPECTED_USES = "petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1" +EXPECTED_USES = "petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v2" def main() -> int: @@ -53,7 +53,7 @@ def main() -> int: print( f"FAIL: {WORKFLOW} job '{job_key}' uses '{uses}'\n" f" Expected: '{EXPECTED_USES}'\n" - f" Fix: replace the `uses:` value with the canonical @v1 ref." + f" Fix: replace the `uses:` value with the canonical @v2 ref." ) return 1