From 2ce36841d48de331031e2a0677201e3f7b6a8a4c Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 12 Sep 2026 17:55:35 -0700 Subject: [PATCH] Pin the vendorHash refresh at basecamp/.github's merged revision The caller pinned the reusable workflow at the head of its pull request branch, which the squash merge of basecamp/.github#19 left off main, so zizmor's impostor-commit audit fails on main. The pin now names the merge commit, 293dc74, which is the same workflow on the default branch. --- .github/workflows/dependabot-auto-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 1d6180d2..72dfaf7e 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -48,7 +48,7 @@ jobs: refresh-nix-vendor-hash: name: Refresh the Nix vendorHash if: github.event_name == 'workflow_dispatch' || (github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]') # zizmor: ignore[bot-conditions] -- dual check: actor validates the current trigger (and stops the App bot's own push from looping back), user.login validates PR origin; on:pull_request, not pull_request_target, so GitHub sets the actor from who pushed - uses: basecamp/.github/.github/workflows/dependabot-sync-nix-vendor-hash.yml@49eaa2156461cee5ac15c5236d3ff3f5fe900d3f + uses: basecamp/.github/.github/workflows/dependabot-sync-nix-vendor-hash.yml@293dc747a2cee44c5b4dae72067adeb681636d26 with: pr: ${{ inputs.pr }} # cli-release-bot's client id — the `release` environment's