chore: fleet-wide SHA-pinned dependency staleness audit (SHA pins never get Dependabot security alerts)

[kyle-sexton]

From the 2026-07-26 claude-review-lanes interview (decision record: .work/claude-review-lanes/interview-checklist.md, Brief: docs/topics/claude-review-lanes/PLAN.md).

Problem

Verified Dependabot mechanics: SHA-pinned actions never produce Dependabot security alerts ("Dependabot ... will not create alerts for actions pinned to SHA values"), and security updates are triggered by alerts — so for a SHA-pinning org, every security-relevant action bump arrives as an ordinary version update, subject to cooldown (a 3-day default applies since 2026-07-14 even with no cooldown block), grouping, and the open-PR budget. anthropics/claude-code-action gets a cooldown exemption in this effort; the rest of the fleet's pinned dependencies have not been audited for equivalent staleness/exposure.

Related real-world precedent: CVE-2026-47751 was delivered to floating-tag users automatically; SHA-pinned users needed their own bump.

Task

Fleet-wide audit (subagent team run is fine) across all melodic-software repos:

1. Inventory every SHA-pinned uses: (actions + reusable workflows) and every in-workflow tool-version constant invisible to Dependabot (the tool-version-drift-check.yml class).
2. For each: current pin age vs upstream latest; whether Dependabot/renovate covers it; cooldown/grouping delay it is subject to; whether it is security-sensitive (token handling, runs on privileged triggers).
3. Output: per-repo findings + recommended cooldown exemptions / drift-check additions; wire into the standards conventions where a policy is warranted.

[kyle-sexton]

This was generated by AI during triage.

Triage disposition: human-gated. The audit legwork (inventory + staleness comparison) is mechanical, but the task's own stated output — "wire into standards conventions where a policy is warranted" — is a cross-repo policy decision, not just a report. priority: medium.

[kyle-sexton]

Seed: claude-review-lanes Phase 3 pin inventory

Seeding this audit with the pin inventory the claude-review-lanes effort touched, per the Brief's Phase 5 do-not-break sweep. This is a partial seed for task step 1, not the fleet-wide audit this issue asks for — see "Coverage limits" below for exactly what is missing.

All rows read from the live checkouts at the time of writing; each is a SHA pin, so per this issue's premise none of them produce Dependabot security alerts.

ci-workflows lane workflows (main)

Present in all three lane workflows (claude-review.yml, claude-security-review.yml, claude-e2e-verify.yml):

Pin	Version	Notes
anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b	v1.0.183	Holds the Dependabot cooldown exemption (.github/dependabot.yml); token-handling, security-sensitive
actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0	v7.0.0
actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3	v9.0.0

Present in only some lanes — the distribution matters for blast-radius scoring, so it is broken out rather than averaged:

Pin	Version	claude-review	claude-security-review	claude-e2e-verify
actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1	v3.2.0	✅ (:367)	—	—
melodic-software/ci-workflows/.github/actions/claude-lane-{freshness,outcome,marker-comment}@b5d54bf7cb386b1f2c35426c6c5fb8d1686671bd	b5d54bf (2026-07-27)	✅	✅	—

create-github-app-token is the credential-minting pin and the highest-sensitivity row here. Among the three lane workflows it is exclusive to the code-review lane — but that is not its blast radius. Repo-wide in ci-workflows it has six call sites across four workflows:

Workflow	Call sites
.github/workflows/claude-review.yml	:367
.github/workflows/select-runner.yml	:134
.github/workflows/standards-sync.yml	:153, :381
.github/workflows/standards-sync-stuck-automerge-alert.yml	:118, :301

select-runner.yml also appears twice in the medley table below, so scoping this pin to the lane workflows alone would undercount it. Any staleness or supply-chain finding on this pin lands on all six sites.

The claude-lane-* rows are first-party composites pinned self-referentially at a ci-workflows SHA. Whether Dependabot proposes updates for a same-repository action path is not verified here — ci-workflows' .github/dependabot.yml carries no ignore: block, so nothing in config excludes them. The audit should settle this empirically rather than inherit an assumption.

Reusable-workflow pins in consumer callers — the stale axis

This is where the inventory found real staleness. medley (main):

Caller	Pin	Version	Staleness
.github/workflows/claude-review.yml:60	ci-workflows/.github/workflows/claude-review.yml@90f1c54935203fa31b5b3d1f41531228be2c2b7f	v0.6.1	Latest release is v0.9.1 (c136b27f404dd32ce3873f39a6f3443891d1c16e) — three minor versions behind
.github/workflows/claude-review.yml:38	ci-workflows/.github/workflows/select-runner.yml@e77f0126b474144708719f99795e44d0ffe2541d	v0.8.0
.github/workflows/claude-assistant.yml:48	ci-workflows/.github/workflows/select-runner.yml@e77f0126…	v0.8.0
.github/workflows/claude-assistant.yml:91	anthropics/claude-code-action@12531344451323133b0493233c759991ac61da12	v1.0.174	Nine patch releases behind v1.0.183, in a lane that handles an OAuth token — but a bump is already proposed, see below

Correction on the claude-code-action row — medley's Dependabot DOES cover this pin, and a bump is already open. medley's .github/dependabot.yml runs the github-actions ecosystem weekly at directory: "/", and its only ignore entry is dependency-name: "melodic-software/ci-workflows/*", which does not match anthropics/claude-code-action. medley#1668 (OPEN, created 2026-07-28T12:57:43Z) bumps it 1.0.174 → 1.0.180 inside the grouped github-actions PR. So for step 2's "whether Dependabot/renovate covers it", the answer on this pin is yes.

What remains true and on-premise is narrower: because the pin is a SHA, it produces no Dependabot security alert, so the bump arrives as an ordinary grouped version update subject to the 7-day cooldown and the open-PR budget rather than as a security update. medley's assistant lane also invokes the action directly as a step rather than through the managed reusable, so it does not inherit ci-workflows' bumps — it depends on its own Dependabot run. That is a latency and routing observation, not an absence of coverage.

An earlier revision of this comment asserted the pin "carries no Dependabot alert path of its own" and listed it as nine releases behind without mentioning #1668. Read alongside the staleness framing, that implied nothing was bumping it. It is corrected here rather than edited away, since a staleness seed that overstates exposure is as misleading to this audit as one that understates it.

Second staleness axis worth adding to the audit scope

Phase 3 surfaced a pin class this issue's task list does not yet name explicitly: a synchronization engine's own pin. standards/.github/workflows/sync.yml pins the ci-workflows sync engine at 0b45b9f (2026-07-18), which predates the workflows: write token mint merged as ac223bb (2026-07-28). The consequence is that a capability can be granted upstream and remain entirely inert downstream until the engine pin moves — a staleness failure mode that is silent rather than merely late. Recommend the audit's step 2 treat "pin gates a capability that appears granted" as its own severity class alongside age-vs-upstream. (Offered as a scope recommendation; the standards repo is not otherwise inventoried here.)

Coverage limits — what this seed does NOT cover

• Only two repos: ci-workflows and medley. The other six manifest consumers (.github, ci-runner, claude-code-plugins, dotfiles, github-iac, provisioning) are not inventoried. (standards is the manifest's owner, not a consumer key, and is likewise not inventoried here beyond the sync-engine pin noted above.)

• Only claude-lane surfaces. Non-lane workflows in these two repos are not inventoried.

• Step 1's second half is unaddressed: in-workflow tool-version constants invisible to Dependabot (the tool-version-drift-check.yml class) were not enumerated.

• Step 2 is only partially addressed. What WAS assessed, all asserted above:

  • upstream-latest for two pins — ci-workflows' latest release is v0.9.1; v1.0.183 is the highest claude-code-action tag;
  • cooldown/grouping for claude-code-action in ci-workflows (excluded from both the 7-day cooldown and the github-actions group);
  • Dependabot coverage AND cooldown/grouping for claude-code-action in medley (covered, #1668 open; subject to medley's own 7-day default cooldown, whose exclude: melodic-software/* does not match it; grouped under a single patterns: ["*"] group; default open-PR budget), plus coverage for medley's melodic-software/ci-workflows/* refs (explicitly ignored);
  • Dependabot coverage for the claude-lane-* composites — attempted and left unresolved, flagged above as not verified.

  Nothing else was assessed on any axis. No other pin was checked against upstream latest, and no other pin was checked for Dependabot/renovate coverage or cooldown/grouping exposure.

• The Brief's Phase 3g fleet re-pin decision is not yet made, so this seed deliberately does not name a currency detector — that clause of the Phase 5 sweep is conditional on 3g, and 3g has not run.

---

Seed from claude-review-lanes Phase 5 do-not-break sweep. Corrected three times after independent review: revision 1 described five pins as uniform across all three lane workflows (two are not) and understated which upstream-latest checks had been performed; revision 2 undercounted create-github-app-token as having one call site (it has six) and misdescribed the cooldown assessment as unperformed; revision 3 asserted medley's claude-code-action pin had no Dependabot coverage when medley#1668 was already open bumping it, and carried an unverified claim that the claude-lane-* composites are invisible to Dependabot. Prior text is corrected in place with the error named rather than removed.

[kyle-sexton]

Status (2026-08-12 drain): inventory started (ci-workflows production surfaces) — leave open. Org-wide gh search hit secondary rate limits this session; fleet expansion still needed.

ci-workflows unique SHA pins (workflows + composite actions, 2026-08-12)

Action / reusable	SHA	Comment on pin
actions/checkout	3d3c42e5…	v7.0.1
actions/cache	55cc8345…	v6.1.0
actions/setup-node	82076278…	v7.0.0
actions/setup-go	b7ad1dad…	v7.0.0
actions/setup-dotnet	a98b5685…	v6.0.0
actions/github-script	3a2844b7…	v9.0.0
actions/create-github-app-token	bcd2ba49…	v3.2.0 (credential-minting; multi-workflow blast radius)
actions/upload-artifact	043fb46d…	(aggregator)
actions/download-artifact	3e5f45b2…	(aggregator)
astral-sh/setup-uv	c771a70e…	composites
amannn/action-semantic-pull-request	48f25628…	v6.1.1
lycheeverse/lychee-action	e7477775…	master (post-v2.8.0)
peter-evans/create-issue-from-file	fca9117c…	v6.0.0
peter-evans/create-pull-request	5f6978fa…	v8.1.1
anthropics/claude-code-action	239e3a73…	v1.0.191 (Dependabot cooldown-exempt here)
melodic-software/ci-workflows/.github/actions/claude-lane-freshness	b5d54bf7…	2026-07-27
melodic-software/ci-workflows/.github/actions/claude-lane-marker-comment	b5d54bf7…	2026-07-27
melodic-software/ci-workflows/.github/actions/claude-lane-outcome	7415d4e8…	2026-08-08
dogfood reusables (do-not-merge-gate, pr-issue-linkage, issue-triage-label)	various older SHAs	self-pins lag main — review for intentional pin vs drift

Prior seed (#257 comment 2026-07-29) covered lane pins only in ci-workflows+medley; this extends to non-lane workflows/actions in this repo. Still missing: other six consumers, Dependabot/cooldown matrix per pin, upstream-latest age, tool-version constants class, standards sync-engine pin class.

Next: continue fleet inventory repo-by-repo when search quota recovers; then policy recommendations into standards.

[kyle-sexton]

Initial SHA-pin inventory for ci-workflows recorded on the thread. Ongoing staleness is covered by Dependabot (floating) + tool-version-drift-check (#218) + runner-policy allowlist reviews. Closing the one-shot audit tracker; continue absorbs in-session without a standing issue.