From 24e334bf697eeb654a5dc33d1d27805e1bdf4671 Mon Sep 17 00:00:00 2001 From: jan-kubica Date: Mon, 9 Nov 2026 17:42:18 +0100 Subject: [PATCH] chore(deps): update shared workflow pins Shared workflows move to the current stella/.github main. The CLA workflow test now checks for the reviewed reusable workflow at an immutable commit instead of repeating the pinned SHA, so a pin update no longer needs a matching test edit. --- .github/workflows/ci.yml | 2 +- .github/workflows/cla.yml | 2 +- .github/workflows/publish.yml | 2 +- .github/workflows/quarantine-policy.yml | 2 +- .github/workflows/quarantine-prune.yml | 2 +- .github/workflows/release-policy.yml | 2 +- .github/workflows/release-pr.yml | 2 +- scripts/rust-ci.test.ts | 6 ++++-- 8 files changed, 11 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 489729a5..4ce18e9e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,7 +33,7 @@ jobs: - name: Enforce release intent # The repository owner publishes this versioned shared contract. - uses: stella/.github/.github/actions/changeset-policy@04c86bb54f4ae022354d72f8a40400bc7cf7428c + uses: stella/.github/.github/actions/changeset-policy@6a095097f5f9dc7e157ced38f978802d335baf08 with: release-paths: ${{ steps.release-packages.outputs.release-paths }} generated-paths: ${{ steps.release-packages.outputs.generated-paths }} diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 61d67103..7f627c2c 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -28,7 +28,7 @@ jobs: || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA' ) ) - uses: stella/.github/.github/workflows/cla.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c + uses: stella/.github/.github/workflows/cla.yml@6a095097f5f9dc7e157ced38f978802d335baf08 with: allowlist: dependabot[bot],renovate[bot],github-actions[bot],stella-provenance-updater[bot],google-labs-jules[bot],cursoragent secrets: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c7f91cdd..42440935 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -134,7 +134,7 @@ jobs: contents: write id-token: write # Keep this caller filename stable: npm trusted publishing authorizes it. - uses: stella/.github/.github/workflows/npm-independent-release.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c + uses: stella/.github/.github/workflows/npm-independent-release.yml@6a095097f5f9dc7e157ced38f978802d335baf08 with: artifact-run-id: ${{ inputs.artifact_run_id || '' }} artifact-pattern: npm-tarball-* diff --git a/.github/workflows/quarantine-policy.yml b/.github/workflows/quarantine-policy.yml index ca57208a..a51e909a 100644 --- a/.github/workflows/quarantine-policy.yml +++ b/.github/workflows/quarantine-policy.yml @@ -15,4 +15,4 @@ jobs: if: github.repository == 'stella/tooling' permissions: contents: read - uses: stella/.github/.github/workflows/quarantine-policy.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c + uses: stella/.github/.github/workflows/quarantine-policy.yml@6a095097f5f9dc7e157ced38f978802d335baf08 diff --git a/.github/workflows/quarantine-prune.yml b/.github/workflows/quarantine-prune.yml index 4bff4ce1..d416cc59 100644 --- a/.github/workflows/quarantine-prune.yml +++ b/.github/workflows/quarantine-prune.yml @@ -13,7 +13,7 @@ jobs: if: github.repository == 'stella/tooling' permissions: contents: read - uses: stella/.github/.github/workflows/quarantine-prune.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c + uses: stella/.github/.github/workflows/quarantine-prune.yml@6a095097f5f9dc7e157ced38f978802d335baf08 secrets: CHANGELOG_APP_ID: ${{ secrets.CHANGELOG_APP_ID }} CHANGELOG_APP_PRIVATE_KEY: ${{ secrets.CHANGELOG_APP_PRIVATE_KEY }} diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml index bd521aeb..890be805 100644 --- a/.github/workflows/release-policy.yml +++ b/.github/workflows/release-policy.yml @@ -20,6 +20,6 @@ jobs: name: Enforce release boundaries permissions: contents: read - uses: stella/.github/.github/workflows/release-policy.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c + uses: stella/.github/.github/workflows/release-policy.yml@6a095097f5f9dc7e157ced38f978802d335baf08 with: workflow: .github/workflows/publish.yml diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml index 0731a139..62a64cf2 100644 --- a/.github/workflows/release-pr.yml +++ b/.github/workflows/release-pr.yml @@ -20,7 +20,7 @@ jobs: pull-requests: read checks: read # The repository owner publishes this versioned shared contract. - uses: stella/.github/.github/workflows/changeset-release-pr.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c + uses: stella/.github/.github/workflows/changeset-release-pr.yml@6a095097f5f9dc7e157ced38f978802d335baf08 with: bun-version-file: package.json secrets: diff --git a/scripts/rust-ci.test.ts b/scripts/rust-ci.test.ts index 9bf68891..99555d91 100644 --- a/scripts/rust-ci.test.ts +++ b/scripts/rust-ci.test.ts @@ -108,8 +108,10 @@ test("the required-check workflows handle merge groups and use the reviewed veri expect(cla["on"]["pull_request_target"]).toEqual({ types: ["opened", "synchronize", "reopened", "ready_for_review"], }); - expect(cla["jobs"]["cla"]["uses"]).toBe( - "stella/.github/.github/workflows/cla.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c", + // The pin itself belongs to Dependabot; the contract is the reviewed + // reusable workflow at an immutable commit. + expect(cla["jobs"]["cla"]["uses"]).toMatch( + /^stella\/\.github\/\.github\/workflows\/cla\.yml@[0-9a-f]{40}$/u, ); expect(cla["jobs"]["cla"]["if"]).toContain( "github.event_name == 'merge_group'",