release-tag: name the desired state — Dependabot cannot see an untagged repo - #23
Merged
Merged
Conversation
… untagged repo Falsified live an hour after #21 merged: guest-room has run the exact Dependabot config #21 fans out -- github-actions ecosystem, weekly, grouped -- since June, and its freshly-refreshed group PR (guest-room#61) bumps checkout/codeql/scorecard pins across three workflow files while leaving deps.yml's osv-scan pin untouched at 8b7d8a8, three template moves behind. Same engine, same config. The difference is that those actions have tags: Dependabot resolves 'latest' for a SHA-pinned uses: via the referenced repo's tags, and this repo had none, so the one pin the whole loop exists to move was invisible to the applier. release-tag.yml mints a patch tag on every push to main touching the lanes, templates, or tools (explicit vX.Y.Z via dispatch for minor/major). It holds contents:write on THIS repo only -- nothing org-wide, no broker entry, no new standing grant. Tags are never moved; minting an existing tag fails. Also corrects the head-tracking claim #21 wrote into the template header and README: Dependabot converges callers onto the latest TAG, not the default-branch head. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017RMKHpGXzw9Zkv49fzVssg
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#21's core assumption was falsified an hour after it merged, before the fan-out copied it 57 times. This PR is the repair, plus the correction of what #21 wrote.
The falsification
guest-room has run the exact config #21 fans out —
github-actionsecosystem, weekly, grouped — since June. Its group PR (guest-room#61), refreshed by tonight's scheduled run, bumpscheckout→ v7.0.1,codeql→ v4.37.4,scorecard→ v2.4.4 across three workflow files — and does not touchdeps.yml's osv-scan pin, still at8b7d8a8, three template moves behind.Same engine, same config, one difference: those actions have tags. Dependabot resolves "latest" for a SHA-pinned
uses:via the referenced repo's tags/releases, andci-workflowshas zero. The one pin the whole convergence loop exists to move was structurally invisible to the chosen applier.The repair: name the desired state
release-tag.yml— a patch tag minted on every push tomainthat touches the lanes,templates/, ortools/; explicitvX.Y.Zvia dispatch for a deliberate minor/major. Properties that matter:contents:writeon this repo only. No org-wide authority, no broker entry, no new standing grant — the no-bespoke-actor stance survives intact. The tag is the one piece of state the managed applier needs to act.# vX.Y.Zcomment — exactly the shapecheck_template_pins.pyrequires.concurrency: release-tag) so two racing merges cannot compute the same next-patch.(none)→v0.1.0,v0.1.0→v0.1.1,v1.2.9→v1.2.10.Corrections to #21's text
Template header and README both claimed Dependabot converges callers onto the default-branch head. Wrong — it converges onto the latest tag. Both corrected with the guest-room evidence cited, since the fan-out copies the template header into every repo.
After this merges
release-tag.ymlonce to seedv0.1.0(the merge push also triggers it viatemplates/**, whichever lands first — the loser fails loudly on "tag exists", which is correct).templates/dependabot.ymlto the ~57 callers (append-don't-clobber for guest-room and prx, which have existing configs).fail-on-lagflips whenbehind: 0.🤖 Generated with Claude Code
https://claude.ai/code/session_017RMKHpGXzw9Zkv49fzVssg
Generated by Claude Code