build: govern every ci-workflows ref and repair pin provenance - #189
Merged
Conversation
The Dependabot ignore covered only reusable workflow refs, so composite action refs under .github/actions/* bumped ungoverned and left every trailing provenance comment claiming the pre-bump commit. Widen the ignore to all melodic-software/ci-workflows refs (governed refs move only through the reviewed selector-revision lockstep) and repair each drifted comment to the pinned commit's short SHA and commit date. Part of melodic-software/github-iac#89. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D5wqdo4adEZmWgjpY9ZjVx
|
Claude finished @kyle-sexton's task in 0s —— View job I'll analyze this and get back to you. |
kyle-sexton
added a commit
that referenced
this pull request
Jul 18, 2026
Codex review on the dotfiles sibling verified the broad ignore is deliberate: #189 widened it because ungoverned composite-action bumps drift adjacent pin-provenance comments (melodic-software/github-iac#89), but left the comment describing the older narrow posture. The comment was the stale artifact, not the pattern. Adopt medley's self-consistent wording documenting that both ref kinds are ignored on purpose. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PDxVbV5HvMA7pji43USWcQ
kyle-sexton
added a commit
that referenced
this pull request
Jul 18, 2026
## Summary No linked issue — D5 adjacent hygiene observation from the ci-runner-alignment audit walkthrough, direction reversed by Codex review evidence on the dotfiles sibling. Originally narrowed the ignore pattern to match the comment. History shows the broad ignore is deliberate: #189 widened it because ungoverned composite-action bumps drift adjacent pin-provenance comments (melodic-software/github-iac#89); the comment was simply never updated. The comment was the stale artifact, not the pattern. Final state: pattern unchanged from main (`melodic-software/ci-workflows/*`); comment rewritten to medley's self-consistent wording documenting that both reusable-workflow and composite-action refs are ignored on purpose. ## Related - melodic-software/ci-runner#99 — walkthrough dispositions record (erratum for this item follows there) - melodic-software/dotfiles#224 — sibling comment fix - #189 — the deliberate widening this preserves 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01PDxVbV5HvMA7pji43USWcQ --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two halves of one defect (melodic-software/github-iac#89, L9):
melodic-software/ci-workflows/.github/workflows/*tomelodic-software/ci-workflows/*— composite action refs were still bumping ungoverned, sidestepping the reviewed-pin discipline documented in the standards runner-policy lockstep.uses: …ci-workflows/.github/actions/*@<sha>comment now matches the pinned commit's short SHA + commit date.Verified zero residual mismatches in this repo (comment hex token must be a prefix of the pinned SHA). A standards runner-policy check making this drift fail red org-wide follows once these repairs land.
🤖 Generated with Claude Code
https://claude.ai/code/session_01D5wqdo4adEZmWgjpY9ZjVx