From f9e91a18d79e584dedc0f564bd7b6725c110afdb Mon Sep 17 00:00:00 2001 From: forkwright Date: Tue, 25 Aug 2026 17:28:38 -0500 Subject: [PATCH] ci: float the first-party reusables on main so they stop freezing A SHA pin on forkwright/.github cannot be maintained. That repo publishes no tags, so dependabot has no version to compare a SHA against and never touches the line -- the pin does not stay reviewed, it freezes. This is measured rather than theoretical. akroasis sat on a revision predating a fix to the very workflow it called while its own comment asserted dependabot maintained it. typikon's gate failed on a defect already fixed upstream that its pin could not reach; floating it turned the gate green, which is the evidence this change rests on. Across the fleet the same reusable was pinned at three different SHAs in three repos, the oldest seven weeks behind. Where a rationale comment existed it is answered rather than deleted. The concern it raised -- that a mutable ref can change behaviour under an already-merged commit -- is real. But the mitigation it proposed was a manual refresh procedure, and nobody ran it. A first-party reusable holding none of our secrets is not the supply-chain case a SHA pin exists for, and the ci-substrate SPEC settles the convention: triggers, permissions and inputs live in the caller, logic is delegated, pin @main. A floating first-party ref cannot go stale, which is stronger than any process for keeping it fresh. Third-party pins are untouched. Those are the genuine supply-chain case, dependabot does maintain them, and they stay on a SHA. --- .github/workflows/gate-attestation.yml | 6 +++++- .github/workflows/release-please.yml | 3 +++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/gate-attestation.yml b/.github/workflows/gate-attestation.yml index e6e8f30..4d80214 100644 --- a/.github/workflows/gate-attestation.yml +++ b/.github/workflows/gate-attestation.yml @@ -58,7 +58,11 @@ permissions: jobs: gate: - uses: forkwright/.github/.github/workflows/hybrid-gate.yml@d74efb1d2d87ec86717dad5d42d468f6e3cf7994 # main + # WHY @main, not a pinned SHA: forkwright/.github publishes no tags, so a + # SHA pin here has no dependabot bump path and just freezes. forkwright/ + # .github is first-party -- same org, same trust boundary -- not the + # third-party supply-chain case a SHA pin defends against. + uses: forkwright/.github/.github/workflows/hybrid-gate.yml@main with: fmt_cmd: "cargo fmt --all -- --check" check_cmd: "cargo check --workspace --all-targets" diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 0920fe7..b259e96 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -17,6 +17,9 @@ permissions: jobs: release-please: + # WHY @main: forkwright/.github publishes no tags, so a SHA pin here would + # have no dependabot bump path and would just freeze. First-party, + # same-org reusable; fleet convention pins it @main. uses: forkwright/.github/.github/workflows/release-please.yml@main secrets: RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}