ci: pin action refs to SHA + add dependabot.yml — §15 - #18
Merged
Merged
Conversation
7 uses: refs (actions/checkout, actions/configure-pages, ruby/setup-ruby, actions/upload-pages-artifact, actions/deploy-pages, across ci.yml and pages.yml) pinned to full 40-character commit SHAs with the resolved version in a trailing comment. Each resolved live against the tag/branch already in use; none upgraded. ruby/setup-ruby's "v1" is a moving branch, not a tag — its current HEAD happens to coincide exactly with tag v1.321.0, so the trailing comment names that version; same freeze-at-today's-commit behavior as every other pin here. .github/dependabot.yml added: github-actions plus bundler (Gemfile — Jekyll build). No Gemfile.lock is committed (bundler-cache: true builds it fresh in CI); the bundler entry is the standards template's own documented carve-out for "Class C Jekyll repos." Vendored from tgwab-standards templates/dependabot.yml (v2.83.0). Tail of the action-pinning sweep tracked at tgwab-standards#203, deferred out of #125: a GitHub Pages asset repo, not one whose CI reaches a deploy credential, a webhook, or the mail path. Job ids/names left unchanged; checked this repo's ruleset before touching anything. Refs MichalAFerber/tgwab-standards#203 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016beCydw4C9VrgL9eHzGUG2
The bundler entry's only group covered minor/patch; a major gem bump had no group to land in and would have opened its own individual PR outside open-pull-requests-limit's grouping intent — inconsistent with the npm/pip/gomod/cargo entries added elsewhere in this sweep, which all split non-major/major into two groups. Fixed to match, per devops's review: the whole point of adding these ecosystem entries is to keep a repo that's never had dependency automation from being surprised by PR volume, and an ungrouped major-bump path undercuts that. Refs MichalAFerber/tgwab-standards#203 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016beCydw4C9VrgL9eHzGUG2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tail of the estate-wide action-pinning sweep, tracked at tgwab-standards#203 — the 14 static/homelab/internal repos deferred out of #125 because their CI doesn't reach a deploy credential, a webhook, or the mail path.
What changed
actions/checkout@v4@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0actions/configure-pages@v5@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0ruby/setup-ruby@v1(×2)@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0actions/upload-pages-artifact@v3@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1actions/deploy-pages@v4@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5.github/dependabot.yml: github-actions + bundlerAll 7 resolved live against the ref already in use.
ruby/setup-ruby@v1is unusual —v1is a moving branch, not a tag — but its current HEAD happens to land exactly on tagv1.321.0, so the comment names that version. None upgraded.Ecosystem added: bundler
Gemfile(Jekyll —github-pages+webrick). NoGemfile.lockis committed;bundler-cache: truebuilds it fresh in CI. This is the exact carve-out documented in the standards template itself ("Class C Jekyll repos add a third entry with package-ecosystem: bundler"). Capped and grouped the same as every other ecosystem entry in this sweep —open-pull-requests-limit: 3, non-major and major bumps in separate groups (fixed in a follow-up commit on this branch after the first pass left major bumps ungrouped).Job names unchanged
Checked this repo's ruleset before touching anything; no job id or name was renamed.
Refs MichalAFerber/tgwab-standards#203
🤖 Generated with Claude Code
https://claude.ai/code/session_016beCydw4C9VrgL9eHzGUG2
Fleet: unattributed