From 158daa81ccea90c9f9c09a8098125ebf4ec7b156 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 10 Nov 2026 17:29:35 +0000 Subject: [PATCH 1/2] fix(deps): bump devantler-tech/.github/.github/workflows/validate-go-project.yaml Bumps [devantler-tech/.github/.github/workflows/validate-go-project.yaml](https://github.com/devantler-tech/.github) from 20.1.17 to 20.1.18. - [Release notes](https://github.com/devantler-tech/.github/releases) - [Commits](https://github.com/devantler-tech/.github/compare/1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123...9ba573406426900207a3b5afeebe16f2d89ca751) --- updated-dependencies: - dependency-name: devantler-tech/.github/.github/workflows/validate-go-project.yaml dependency-version: 20.1.18 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 96d948a100..e42c5daeb7 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -812,7 +812,7 @@ jobs: || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.changes.outputs.govuln-allowlist == 'true') - uses: devantler-tech/.github/.github/workflows/validate-go-project.yaml@1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123 # v20.1.17 + uses: devantler-tech/.github/.github/workflows/validate-go-project.yaml@9ba573406426900207a3b5afeebe16f2d89ca751 # v20.1.18 # The canonical defaults make a default-branch run answer "did the check run" rather than # "did the diff touch a Go file". On main the branch's green IS the protection # signal, so a path filter that skips the suite or the scan leaves main green From 774bdfde6a3fceef702684f4b7391a17b3e961c2 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 10 Nov 2026 21:30:51 +0100 Subject: [PATCH 2/2] test(ci): review validate-go-project v20.1.18 for the Go maintenance caller Co-Authored-By: Claude Opus 5.5 --- internal/ciharness/go_maintenance_caller_test.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/internal/ciharness/go_maintenance_caller_test.go b/internal/ciharness/go_maintenance_caller_test.go index 56c17ef915..7a6f3d7cd4 100644 --- a/internal/ciharness/go_maintenance_caller_test.go +++ b/internal/ciharness/go_maintenance_caller_test.go @@ -146,6 +146,9 @@ func validateGoMaintenanceIdentity(workflow ciWorkflow, caller todosWorkflow) er // signed-fix callee pins to v20.1.12, whose apply-signed-fixes workflow is byte-identical // to v20.1.6. Inputs, admission, permissions, secrets and the signed-fix opt-out are // unchanged, and it still declares no maintenance-default-branch input. + // v20.1.18 only moves the disabled signed-fix callee pins to v20.1.17, whose + // apply-signed-fixes workflow is byte-identical to v20.1.12. Inputs, admission, + // permissions, secrets and the signed-fix opt-out are unchanged. // Keep explicit reviewed identities: a syntactically valid SHA alone is insufficient. reviewed := slices.Contains([]string{ prefix + "0600006235510307a04efebcac1ac1f363f5f862", @@ -165,6 +168,7 @@ func validateGoMaintenanceIdentity(workflow ciWorkflow, caller todosWorkflow) er prefix + "522038c41420f0c9508a586cb944eda995ad0068", prefix + "15372ea4ee3a0bd5b0a41a18105859691737df01", prefix + "1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123", + prefix + "9ba573406426900207a3b5afeebe16f2d89ca751", }, job.Uses) if !found || !reviewed || len(job.Steps) != 0 || caller.Jobs["ci-go"].RunsOn != "" || !reflect.DeepEqual(job.Needs, []string{"changes"}) { @@ -291,10 +295,10 @@ const ( "522038c41420f0c9508a586cb944eda995ad0068" // The previous reviewed revision; it also declares no maintenance-default-branch. goMaintenanceInputPreviousRevision = "devantler-tech/.github/.github/workflows/validate-go-project.yaml@" + - "15372ea4ee3a0bd5b0a41a18105859691737df01" + "1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123" // The latest reviewed revision; it also declares no maintenance-default-branch. goMaintenanceInputLatestRevision = "devantler-tech/.github/.github/workflows/validate-go-project.yaml@" + - "1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123" + "9ba573406426900207a3b5afeebe16f2d89ca751" ) type goMaintenanceMutation struct {