Skip to content

Compliance: unpinned-actions-dependabot-automerge.yml #156

Closed
Closed
Compliance: unpinned-actions-dependabot-automerge.yml#156
Labels
compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

Description

@don-petry
don-petry
opened on Apr 9, 2026

Compliance Finding

Category: action-pinning
Severity: error
Check: unpinned-actions-dependabot-automerge.yml

Detail

Workflow dependabot-automerge.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1

Standard Reference

standards/ci-standards.md#action-pinning-policy

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    compliance-auditAutomated compliance audit finding
    on Apr 9, 2026

  2. don-petry commented on Apr 9, 2026

    @don-petry
    don-petry
    on Apr 9, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-04-09)

    This finding is still open.

    Detail: Workflow dependabot-automerge.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1

    Standard: standards/ci-standards.md#action-pinning-policy

  3. don-petry
    added
    claude
    on Apr 9, 2026

  4. don-petry commented on Apr 9, 2026

    @don-petry
    don-petry
    on Apr 9, 2026
    CollaboratorAuthor

    Claude encountered an error —— View job

    I'll analyze this and get back to you.

  5. don-petry commented on Apr 10, 2026

    @don-petry
    don-petry
    on Apr 10, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-04-10)

    This finding is still open.

    Detail: Workflow dependabot-automerge.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1

    Standard: standards/ci-standards.md#action-pinning-policy

  6. don-petry
    added
    claude
    and removed
    claude
    on Apr 14, 2026

  7. don-petry commented on Apr 14, 2026

    @don-petry
    don-petry
    on Apr 14, 2026
    CollaboratorAuthor

    Claude finished @don-petry's task in 1m 36s —— View job • claude/issue-156-20260414-1116 • Create PR ➔

    Fixing Unpinned Action in dependabot-automerge.yml

    • Analyze issue and gather context
    • Fetch standard workflow template from org
    • Look up SHA for v1 tag → ae9709f4466dec60a5733c9e7487f69dcd004e05
    • Update dependabot-automerge.yml with pinned SHA
    • Commit and push changes
    • Create PR and tag code owner

    Pinned the reusable workflow reference from @v1 to its commit SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 # v1, resolving the action-pinning compliance finding.

    |

  8. don-petry
    added a commit that references this issue on Apr 14, 2026

    fix: pin dependabot-automerge reusable workflow to SHA

    c45f496

  9. don-petry commented on Apr 17, 2026

    @don-petry
    don-petry
    on Apr 17, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-04-17)

    This finding is still open.

    Detail: Workflow dependabot-automerge.yml has 1 action(s) not pinned to SHA: uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1

    Standard: standards/ci-standards.md#action-pinning-policy

  10. don-petry
    added
    claude
    and removed
    claude
    on Apr 18, 2026

  11. don-petry commented on Apr 18, 2026

    @don-petry
    don-petry
    on Apr 18, 2026
    CollaboratorAuthor

    Claude encountered an error —— View job

    I'll analyze this and get back to you.

  12. don-petry
    added
    claude
    and removed
    claude
    on Apr 20, 2026

  13. 21 remaining items

  14. don-petry
    added
    claude
    and removed
    claude
    on May 21, 2026

  15. don-petry commented on May 21, 2026

    @don-petry
    don-petry
    on May 21, 2026
    CollaboratorAuthor

    Resolution: No Change Required — Compliant by Org Standard

    After investigation, this finding is a false positive that has already been addressed upstream.

    Root Cause

    The compliance audit that created this issue was running an older version of the script that did not yet have the exemption for internal reusable workflow refs.

    Org Standard

    explicitly exempts internal reusable workflow refs from SHA pinning:

    # CORRECT — tag ref for internal reusable workflow
uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1

# WRONG — do not SHA-pin internal reusable workflow refs
uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@<sha>

    The canonical tags (e.g. @v1, @v2) on petry-projects/.github are managed deliberately and are not subject to tag-force-push risk because the org controls the tag. Do not open compliance PRs to pin these references.

    Fix Applied

    The compliance audit script was updated in petry-projects/.github commit e4c1475 to add the exemption:

    grep -vE 'uses:[[:space:]]+petry-projects/(\.github|\.github-private)/'

    This means future compliance audits will not flag dependabot-automerge.yml for using @v1 — which is the correct, standards-compliant pattern.

    No changes to .github/workflows/dependabot-automerge.yml are needed.

  16. don-petry
    closed this as completedon May 21, 2026

  17. don-petry commented on May 21, 2026

    @don-petry
    don-petry
    on May 21, 2026
    CollaboratorAuthor
    Already working on this: an open PR exists for issue #156.

  18. don-petry commented on May 21, 2026

    @don-petry
    don-petry
    on May 21, 2026
    CollaboratorAuthor
    Already working on this: an open PR exists for issue #156.
  19. don-petry
    reopened this on Jun 2, 2026
  20. don-petry
    added
    dev-leadFor dev-lead agent pickup
    on Jun 2, 2026

  21. don-petry commented on Jun 2, 2026

    @don-petry
    don-petry
    on Jun 2, 2026
    CollaboratorAuthor

    Dev-Lead Implementation Plan

    Issue: #156 — Compliance: unpinned-actions-dependabot-automerge.yml

    Scope

    Pin the reusable workflow reference in .github/workflows/dependabot-automerge.yml from the tag @v2 to its full commit SHA, matching the established pattern in this repository.

    Implementation Checklist

    • Resolve the commit SHA for petry-projects/.github tag v2 (SHA: 376a4fcb1117444595e3e702fa450873d0e54310)
    • Update .github/workflows/dependabot-automerge.yml line 38: replace @v2 with @376a4fcb1117444595e3e702fa450873d0e54310 # v2

    Tests to Write

    No tests needed — this is a pure workflow configuration change with no observable behavioral change in the repository's own test suite. The CI configuration itself is the artifact being fixed.

    Test Command

    npm test (no changes to application code, but run to confirm nothing is broken)

    Notes

    • Other workflows in this repo follow the same SHA-pinning pattern: auto-rebase.yml uses @d3d768dabb7f28cc63283cdfe48630da53700e50 # v1, dependabot-rebase.yml uses @ab01ba34e6dc3fd0a02c795178455efdd3bec0a9 # v1
    • The issue body references @v1 but the current file already uses @v2; the fix applies the same SHA-pinning to whichever tag is currently in use (v2)

  22. don-petry commented on Jun 2, 2026

    @don-petry
    don-petry
    on Jun 2, 2026
    CollaboratorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Resolved commit SHA for petry-projects/.github tag v2 via GitHub API: 376a4fcb1117444595e3e702fa450873d0e54310
    • Updated .github/workflows/dependabot-automerge.yml line 38: replaced @v2 with @376a4fcb1117444595e3e702fa450873d0e54310 # v2
    • Skipped TDD phase (pure configuration change, no observable behavioral change in test suite)
    • Verified full test suite passes (301/301)
    • Verified lint/format checks pass (0 errors)

    Test Results

    > google-app-scripts@0.0.0 test
> jest --runInBand

Test Suites: 12 passed, 12 total
Tests:       301 passed, 301 total
Snapshots:   0 total
Time:        4.179 s
Ran all test suites.

    Files Changed

    • .github/workflows/dependabot-automerge.yml: Pinned reusable workflow ref from @v2 to @376a4fcb1117444595e3e702fa450873d0e54310 # v2, matching the SHA-pinning pattern established by auto-rebase.yml and dependabot-rebase.yml

    Notes

    The issue body referenced @v1 but the current file already used @v2; the fix pins the tag that was actually in use (v2) to its corresponding commit SHA. The SHA was confirmed via gh api repos/petry-projects/.github/git/refs/tags/v2.

  23. don-petry commented on Jun 5, 2026

    @don-petry
    don-petry
    on Jun 5, 2026
    CollaboratorAuthor

    Resolved! This check is now passing as of 2026-06-05. Closing automatically.

  24. don-petry
    closed this as completedon Jun 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions