templates: Dependabot is the applier; the census stays the verifier (#10) - #21
Merged
Merged
Conversation
) Decides ci-workflows#10's standing mechanism. The system decomposes the way OpenTofu does: templates/deps.yml is the desired state, caller-pins.yml is the plan (an ancestry diff of actual vs desired), and something must be the apply. Dependabot's github-actions ecosystem is that applier -- it updates 'uses:' SHA pins natively, converging callers onto the head the template pin names at bump time. Chosen over a broker-credentialed re-pin bot because the engine is GitHub-maintained rather than ours to keep working; because a custom actor would need org-wide contents:write PLUS the workflows permission (GitHub rejects workflow-file pushes without it), minted from an entry that would make this repo's main a lever over every repo's contents -- the posture change SHA pins exist to avoid; and because Dependabot covers what the census cannot see: consumers calling the lane from inside a combined workflow (infra's _infra-test.yml), and every other action pin (checkout, setup-node) going stale the same way. It also subsumes the bulk re-pin: once the config lands per repo, Dependabot opens the 43 outstanding re-pin PRs itself on its first cycle. The census stays on as the independent verifier -- Dependabot proposes, a human merges, the Monday census proves. Once the fleet reads current, flip fail-on-lag to true: plan must be empty. Self-adopted here as .github/dependabot.yml, byte-identical to the template. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017RMKHpGXzw9Zkv49fzVssg
bdelanghe
marked this pull request as ready for review
August 3, 2026 23:50
bdelanghe
pushed a commit
that referenced
this pull request
Aug 3, 2026
… untagged repo Falsified live an hour after #21 merged: guest-room has run the exact Dependabot config #21 fans out -- github-actions ecosystem, weekly, grouped -- since June, and its freshly-refreshed group PR (guest-room#61) bumps checkout/codeql/scorecard pins across three workflow files while leaving deps.yml's osv-scan pin untouched at 8b7d8a8, three template moves behind. Same engine, same config. The difference is that those actions have tags: Dependabot resolves 'latest' for a SHA-pinned uses: via the referenced repo's tags, and this repo had none, so the one pin the whole loop exists to move was invisible to the applier. release-tag.yml mints a patch tag on every push to main touching the lanes, templates, or tools (explicit vX.Y.Z via dispatch for minor/major). It holds contents:write on THIS repo only -- nothing org-wide, no broker entry, no new standing grant. Tags are never moved; minting an existing tag fails. Also corrects the head-tracking claim #21 wrote into the template header and README: Dependabot converges callers onto the latest TAG, not the default-branch head. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017RMKHpGXzw9Zkv49fzVssg
bdelanghe
added a commit
that referenced
this pull request
Aug 3, 2026
…ed repo (#23) Falsified live an hour after #21 merged: guest-room has run the exact Dependabot config #21 fans out since June, and its freshly-refreshed group PR (guest-room#61) bumps checkout/codeql/scorecard pins across three workflow files while leaving deps.yml's osv-scan pin untouched at 8b7d8a8, three template moves behind. Same engine, same config. The difference is tags: Dependabot resolves 'latest' for a SHA-pinned uses: via the referenced repo's tags, and this repo had none, so the one pin the loop exists to move was invisible to the applier. release-tag.yml mints a patch tag on every push to main touching the lanes, templates, or tools (explicit vX.Y.Z via dispatch). contents:write on THIS repo only -- no org-wide authority, no broker entry. Tags are never moved; minting an existing tag fails. Serialized so racing merges cannot compute the same next-patch. Also corrects the head-tracking claim #21 wrote into the template header and README: Dependabot converges callers onto the latest TAG.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Decides #10's standing mechanism, under the criterion set by the maintainer: strongest derivation, automation, config-as-code, nothing bespoke to maintain.
The decomposition
The system splits the way OpenTofu does:
templates/deps.yml— one declared pincaller-pins.yml— an ancestry diff of actual vs desired (merged in #19/#20)github-actionsecosystem — this PRfail-on-lag: true, flipped once the fleet reads currentDependabot updates
uses:SHA pins natively, converging callers onto the head the template pin names at bump time. A human still merges each PR; the Monday census independently proves convergence happened. Nothing bespoke survives as an actor — the only custom code in the loop is the census, which is pure verification.Why not the broker-credentialed re-pin bot
Three reasons, two of them discovered while weighing it:
.github/workflows/*from tokens without theworkflowspermission — so beyond org-widecontents:write, the App likely needs a permission escalation. And aGH_APPSentry pinned to a workflow onmainmakes this repo'smainable to mint that authority immediately — a lever over every repo's contents that SHA pins currently prevent. That's a posture change, not a config change._infra-test.yml— wrong filename, private repo, invisible tocaller-pins.py) get converged anyway, as does every other action pin (checkout,setup-node,setup-deno) going stale by the same mechanism. The bespoke bot fixes one instance; this fixes the class.It subsumes the bulk re-pin
Once
.github/dependabot.ymllands in a caller, Dependabot's first cycle opens that repo's re-pin PR itself — so the 43-repo backlog and the standing mechanism are the same rollout, not two.What's in this PR
templates/dependabot.yml— the org-standard config:github-actionsecosystem, weekly Monday, all bumps grouped into one PR per repo (58 ungrouped weekly PRs is a noise machine nobody reads),cicommit prefix (semantic-PR gates in this org rejectdeps:— learned live on claude-box during the rollout)..github/dependabot.yml— self-adopted here, byte-identical.The template header states the one sanctioned divergence: a repo that already has a
dependabot.yml(other ecosystems — conformance-kit has npm) appends thegithub-actionsentry rather than clobbering. Byte-identity is the norm, not a law.After this merges
deps.yml; the fan-out PRs are pure config).behind: 0— flipfail-on-lagtotrue. Plan must be empty, forever after.🤖 Generated with Claude Code
https://claude.ai/code/session_017RMKHpGXzw9Zkv49fzVssg
Generated by Claude Code