From 8c7813c2edec63078047463b35dcf4bba34df9ef Mon Sep 17 00:00:00 2001 From: Jon Bogaty Date: Mon, 27 Jul 2026 02:30:44 -0500 Subject: [PATCH] fix: repair two fabricated SHA pins and pre-existing whitespace MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both of these break CI/automerge for every PR, not just mine: - .github/workflows/automerge.yml pinned dependabot/fetch-metadata to db3088a99b59bc669c5853f669e2003c23d06b52 labeled "# v3.0.0" — that SHA does not exist in dependabot/fetch-metadata at all (confirmed via `gh api repos/dependabot/fetch-metadata/commits/` -> 422 "No commit found"). Every dependabot PR's automerge job has been unable to resolve this action and failing outright as a result. Fixed to the real v3.0.0 SHA (ffa630c65fa7e0ecfa0625b5ceda64399aea1b36, verified against the tags API — this exact SHA is what dependabot's own PR #7, "bump dependabot/fetch-metadata from 2.5.0 to 3.0.0", already carries, but #7 targets .github/workflows/dependabot- automerge.yml, a file that doesn't exist until #16 merges, so it can't land the fix to the actual current file). - While auditing every SHA pin across all workflow files for the same class of bug (`gh api repos///commits/` per pin), found a second one: .github/workflows/release.yml pinned softprops/action-gh-release to c95fe1489396fe8a9eb87c0abf8ad5bc06adad52 labeled "# v6.0.0" — that SHA doesn't exist either, and v6.0.0 has never been released (the action tops out at v3.0.2). Fixed to the real, current v3.0.2 SHA. - install.bash: same pre-existing trailing-whitespace lint failure fixed on codex/production-hardening/chore/consolidate-actions-bumps/ fix/python-dependency-vulnerabilities — applying here too since it's currently failing on main itself for any PR that touches this file. All other SHA-pinned actions across every workflow file verified to exist via the same commits-API check (actions/checkout, actions/ deploy-pages, actions/upload-pages-artifact, astral-sh/setup-uv, googleapis/release-please-action, SonarSource/sonarqube-scan-action — all confirmed real). make lint / make test both green. --- .github/workflows/automerge.yml | 2 +- .github/workflows/release.yml | 2 +- install.bash | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index e6d0cb4..1a51e0c 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@db3088a99b59bc669c5853f669e2003c23d06b52 # v3.0.0 + uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v3.0.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Enable auto-merge for Dependabot PRs diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c0a0cf1..8706ba7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,6 +13,6 @@ jobs: - name: Package run: ./scripts/package.sh dist "${GITHUB_REF_NAME}" - name: Upload tarball - uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8ad5bc06adad52 # v6.0.0 + uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: files: dist/get-bashed-${{ github.ref_name }}.tar.gz diff --git a/install.bash b/install.bash index 44a364c..21793f1 100755 --- a/install.bash +++ b/install.bash @@ -19,7 +19,7 @@ fi usage() { cat <<'USAGE' Usage: install.sh [--prefix PATH] [--force] [--with-ui] - [--auto] [--yes] + [--auto] [--yes] [--profiles minimal|dev|ops[,..]] [--features gnu_over_bsd,build_flags,...] [--install brew,asdf,doppler,...] @@ -71,7 +71,7 @@ GET_BASHED_GIT_SIGNING=0 while [[ $# -gt 0 ]]; do case "$1" in - --prefix) + --prefix) if [[ $# -lt 2 ]]; then echo "Error: --prefix requires a value" >&2 usage