From bbaca5925601499abcd46f5df8326f25b65f4f17 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 23:27:30 +0000 Subject: [PATCH 1/3] chore(ci): Update github-actions --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/claude.yml | 2 +- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/release.yml | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6c8350ad..8f74ffcc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,7 +28,7 @@ jobs: version: ${{ env.PNPM_VERSION }} - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: ".nvmrc" cache: "pnpm" @@ -91,7 +91,7 @@ jobs: version: ${{ env.PNPM_VERSION }} - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: ".nvmrc" cache: "pnpm" @@ -149,7 +149,7 @@ jobs: version: ${{ env.PNPM_VERSION }} - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: ".nvmrc" cache: "pnpm" @@ -209,7 +209,7 @@ jobs: version: ${{ env.PNPM_VERSION }} - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: ".nvmrc" cache: "pnpm" diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 0125205d..d2bf73d7 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -32,7 +32,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@fd1c128679612beff4ca259c78021c506e8aa7a7 # v1.0.237 + uses: anthropics/claude-code-action@2dca132ff0e0c4094ce6048b422c6915a071210b # v1.0.247 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index aca18e7c..937bc261 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,7 +20,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} @@ -38,11 +38,11 @@ jobs: # install` here failed on every scheduled run since at least # 2026-06-22, so JS/TS CodeQL analysis was silently not running. # CodeQL is cron-only, so no PR ever surfaced it. - version: "11.28.2" + version: "11.28.5" - name: Setup Node.js if: matrix.language == 'javascript-typescript' - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: ".nvmrc" cache: "pnpm" @@ -56,4 +56,4 @@ jobs: run: pnpm build - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 00bd72e7..19e65c42 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -47,7 +47,7 @@ jobs: version: ${{ env.PNPM_VERSION }} - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: ".nvmrc" From fb3b4fd7237f64ec1b4b0e121e3b193169601ee4 Mon Sep 17 00:00:00 2001 From: thewrz Date: Fri, 16 Oct 2026 14:21:55 -0700 Subject: [PATCH 2/3] fix(ci): align dependency tooling and harden workflows Synchronize pnpm maintenance versions, preserve the deferred pnpm major, and fix release verification prerequisites. Remove persisted checkout credentials, unnecessary permissions and implicit release caching. Closes #720 Co-Authored-By: Codex --- .depcheckrc.yaml | 3 ++- .github/dependabot.yml | 5 ++--- .github/workflows/ci.yml | 10 ++++++++-- .github/workflows/claude.yml | 6 +++++- .github/workflows/codeql.yml | 2 ++ .github/workflows/release.yml | 6 +++++- renovate.json | 5 +++++ 7 files changed, 29 insertions(+), 8 deletions(-) diff --git a/.depcheckrc.yaml b/.depcheckrc.yaml index 3e52501e..6cfcb91a 100644 --- a/.depcheckrc.yaml +++ b/.depcheckrc.yaml @@ -1,8 +1,9 @@ -# depcheck config. These devDependencies are real but invisible to static +# depcheck config. These dependencies are real but invisible to static # analysis — they run via a CLI bin or are loaded at runtime, never `import`ed # from src/. Listing them keeps `pnpm exec depcheck` (release.yml) green. ignores: - "@redocly/cli" # `redocly` bin — openapi.yaml lint (lint script + CI) - depcheck # this tool itself - pino-pretty # loaded by pino at runtime as a transport (src/lib/logger.ts) + - pino-roll # loaded by pino at runtime for LOG_TO_FILE (src/lib/logger.ts) - dotenv # loaded by node-pg-migrate at runtime (migrate/migrate:down --envPath .env) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7e34207f..d7ec3c70 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -39,9 +39,8 @@ updates: # --- workflow action pins --- # Where an action is SHA-pinned (security.md), Dependabot updates the pin and # the trailing version comment together. ci.yml, release.yml and codeql.yml are - # fully SHA-pinned; claude.yml still uses floating `@v7`/`@v1` tags — tracked - # in #600. Dependabot bumps a floating tag but cannot make it immutable, so it - # is not a substitute for the pin. + # fully SHA-pinned, including claude.yml (fixed in #600). The local/CI + # check:action-pins gate prevents a return to floating tags. - package-ecosystem: "github-actions" directory: "/" schedule: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8f74ffcc..51d9f53f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,10 +9,9 @@ on: permissions: contents: read - security-events: write env: - PNPM_VERSION: "11.28.2" + PNPM_VERSION: "11.28.5" jobs: # ─── Lint ──────────────────────────────────────────────────────────── @@ -21,6 +20,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install pnpm uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 @@ -84,6 +85,8 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install pnpm uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 @@ -202,6 +205,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install pnpm uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 @@ -239,6 +244,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - name: Compute LOC delta env: diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index d2bf73d7..8841c4ed 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -1,6 +1,9 @@ name: Claude Code on: + # Intentional interactive trigger. The pinned action checks repository write + # access before tag-mode execution and rejects bots by default. Keep + # allowed_non_write_users and allowed_bots unset (see #720). issue_comment: types: [created] pull_request_review_comment: @@ -29,10 +32,11 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 + persist-credentials: false - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@2dca132ff0e0c4094ce6048b422c6915a071210b # v1.0.247 + uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc # v1.0.248 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 937bc261..e3913958 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,8 @@ jobs: language: [javascript-typescript, actions] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Initialize CodeQL uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 19e65c42..fd0c77a7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,7 +9,7 @@ permissions: contents: write env: - PNPM_VERSION: "11.28.2" + PNPM_VERSION: "11.28.5" jobs: create-release: @@ -50,6 +50,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: ".nvmrc" + package-manager-cache: false - name: Install dependencies run: pnpm install --frozen-lockfile @@ -77,6 +78,9 @@ jobs: - name: Run database migrations (smoke test) run: pnpm migrate + - name: Seed CSI section reference data + run: pnpm seed + - name: Run full test suite run: pnpm test && pnpm test:integration diff --git a/renovate.json b/renovate.json index 3e7650ee..d8033eb0 100644 --- a/renovate.json +++ b/renovate.json @@ -6,6 +6,11 @@ "labels": ["dependencies"], "commitMessagePrefix": "chore(deps):", "packageRules": [ + { + "description": "Keep the existing pnpm 11 toolchain decision from #668. A major upgrade must coordinate all workflows and both isolated workspaces; 11.x maintenance updates remain enabled.", + "matchPackageNames": ["pnpm"], + "allowedVersions": "<12.0.0" + }, { "matchManagers": ["npm"], "groupName": "npm-deps" From 0e57858c4b34e844d67e37a60f1d883624586c73 Mon Sep 17 00:00:00 2001 From: thewrz Date: Fri, 16 Oct 2026 15:04:54 -0700 Subject: [PATCH 3/3] fix(ci): let Renovate synchronize all pnpm workflow pins Co-Authored-By: Codex --- .github/workflows/codeql.yml | 6 +++--- .github/workflows/release.yml | 1 + renovate.json | 13 ++++++++++++- 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e3913958..a630aecb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,9 +31,9 @@ jobs: uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 with: # Must match ci.yml and release.yml's PNPM_VERSION — keep all three in - # step when bumping. Renovate manages this literal but NOT the - # PNPM_VERSION env vars, so a bump here silently drifts from the - # others (it did: this read 11.17.0 while both env vars said 11.11.0). + # step when bumping. Renovate's native Actions manager updates this + # literal; its custom pnpm manager updates both PNPM_VERSION env vars. + # All three updates share the github-actions group in renovate.json. # # This job was previously pinned to pnpm 9, which cannot read a pnpm 11 # pnpm-workspace.yaml ("packages field missing or empty") — `pnpm diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fd0c77a7..3277145e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,6 +50,7 @@ jobs: uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: ".nvmrc" + # Release installs run without setup-node's automatic dependency cache. package-manager-cache: false - name: Install dependencies diff --git a/renovate.json b/renovate.json index d8033eb0..71d4a684 100644 --- a/renovate.json +++ b/renovate.json @@ -5,11 +5,22 @@ "automerge": false, "labels": ["dependencies"], "commitMessagePrefix": "chore(deps):", + "customManagers": [ + { + "customType": "regex", + "managerFilePatterns": ["/^\\.github\\/workflows\\/(?:ci|release)\\.yml$/"], + "matchStrings": ["PNPM_VERSION:\\s*\"(?\\d+\\.\\d+\\.\\d+)\""], + "depNameTemplate": "pnpm", + "datasourceTemplate": "npm", + "versioningTemplate": "semver" + } + ], "packageRules": [ { "description": "Keep the existing pnpm 11 toolchain decision from #668. A major upgrade must coordinate all workflows and both isolated workspaces; 11.x maintenance updates remain enabled.", "matchPackageNames": ["pnpm"], - "allowedVersions": "<12.0.0" + "allowedVersions": "<12.0.0", + "groupName": "github-actions" }, { "matchManagers": ["npm"],