Pin the vendorHash refresh at basecamp/.github's merged revision - #709
Conversation
The caller pinned the reusable workflow at the head of its pull request branch, which the squash merge of basecamp/.github#19 left off main, so zizmor's impostor-commit audit fails on main. The pin now names the merge commit, 293dc74, which is the same workflow on the default branch.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
🟢 Approved
The focused pin update resolves the reported audit failure.
Pull request overview
This pull request updates the Dependabot vendor-hash workflow pin to the merged default-branch revision.
Changes:
- Replaces the branch-head SHA with merge commit
293dc74.
File summaries
| File | Description |
|---|---|
.github/workflows/dependabot-auto-merge.yml |
Updates the reusable workflow commit pin. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite (auto)
Note
Copilot is running an experiment and ran this review at Lite.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The caller from #702 pinned
dependabot-sync-nix-vendor-hash.ymlat the head of basecamp/.github#19's branch. That PR squash-merged as293dc74, so the pinned SHA is not on basecamp/.github's default branch and zizmor'simpostor-commitaudit fails on main. This re-pins to the merge commit, the same workflow on the default branch. zizmor 1.30.0 online and actionlint clean.Summary by cubic
Re-pins the
dependabot-sync-nix-vendor-hashworkflow to its squash-merge commit so zizmor'simpostor-commitaudit passes on main. The previous pin referenced a branch head SHA from basecamp/.github#19 that isn't on the default branch; the new pin points to merge commit293dc74, which is the same workflow on the default branch.Written for commit 2ce3684. Summary will update on new commits.