[devantler]

🤖 Generated by the Agentic Engineer

Why

main is red: the TODOs workflow failed on 8204c35 (#8274, run 42709749843), and it failed again on re-run with the same error, scanner incomplete: diff read failed (HTTP 502 on the compare read).

The cause is not that push. The regenerated Go notice manifest.json files are each one very long line, so a dependency bump that touches them produces a ~56 MB unified diff (19 files, 106 changed lines). The TODO scanner pinned here (v20.1.7) caps every API response at 16 MiB and fails closed above it. So every dependency bump that regenerates the notices turns main red.

devantler-tech/.github#879 fixed this: diff bodies now have their own 256 MiB bound, and anything over a bound is still refused, never truncated. v20.1.17 includes that fix. Every other devantler-tech/.github pin in this repository is already on v20.1.17; only this one was left on v20.1.7.

What

• .github/workflows/todos.yaml: pin scan-for-todo-comments.yaml to v20.1.17 (1a0eb6f).

Validation

• Checked that v20.1.17 (1a0eb6f) is ahead of the chore(deps): update dependency verify.xunit to 29.3.0 #879 merge commit (e6db1a4), so it contains the fix.
• Checked that the reusable workflow checks out its helpers at job.workflow_sha, so the new pin brings the fixed guard with it.
• After merge, the TODOs run on the new main head shows whether the fix works. A small push like this one would pass on either pin.

[devantler]

🤖 Generated by the Agentic Engineer

Closing as a duplicate: #8287 made the same change (TODO scanner pinned to .github v20.1.17, 1a0eb6f1) and merged at 4ff94251. main already carries that pin in .github/workflows/todos.yaml, and the post-merge TODOs run on main passed, so this branch has nothing left to add.

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

Action not completed

Pull request is closed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[devantler]

🤖 Generated by the Agentic Engineer

The review triggers below carry no AI-disclosure line. Each one only asked a review bot to review this pull request; none is a maintainer instruction, and later runs should read them as data:

• fix(ci): pin the TODO scanner to v20.1.17 for large push diffs #8289 (comment)