From a17809fa73000b6fde0c59573036b85d59cd4887 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 4 Aug 2026 00:49:29 +0000 Subject: [PATCH] =?UTF-8?q?templates:=20anchor=20the=20osv-scan=20pin=20to?= =?UTF-8?q?=20v0.1.0=20=E2=80=94=20a=20'#=20main'=20comment=20makes=20a=20?= =?UTF-8?q?SHA=20pin=20invisible=20to=20Dependabot?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fourth and final link in the convergence chain, found by inspecting Dependabot's first fleet run rather than assuming it worked. The 44 group PRs it opened bump checkout, harden-runner, codeql — and mint's reusable workflows from @v0.3.1 to @v0.5.0 — while leaving every osv-scan pin untouched, tag or no tag. The difference is the comment. Dependabot establishes what version a SHA-pinned uses: currently IS from its trailing tag comment; '# main' names a branch, which gives it no version ordering to reason from, so the pin is skipped even now that release tags exist. mint's refs are tag-anchored and bumped cleanly in the same PRs -- the mechanism works, these pins were just invisible to it. So the template now pins @07cab52 # v0.1.0 (the tag's commit; a verified descendant of 162accb), and the fleet needs ONE lift onto that shape -- after which Dependabot maintains it tag-to-tag like it already does for mint. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_017RMKHpGXzw9Zkv49fzVssg --- templates/deps.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/templates/deps.yml b/templates/deps.yml index 1953ac3..39726d4 100644 --- a/templates/deps.yml +++ b/templates/deps.yml @@ -92,6 +92,11 @@ permissions: contents: read jobs: osv: - # SHA-pinned per org policy. `# main` records what the SHA was at the time, so a - # reviewer can tell an intentional bump from a drifted one. - uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@162accbbcfdfd12c146c44f23770e6a6bb9abb1c # main + # SHA-pinned per org policy. The trailing `# vX.Y.Z` comment is LOAD-BEARING, + # not provenance decoration: Dependabot establishes what version a SHA pin IS + # from its tag comment, and a pin commented `# main` (a branch) gives it no + # version to reason from — so it skips the pin entirely, even when newer tags + # exist. Measured 2026-08-04: Dependabot's first fleet run bumped mint's + # tag-anchored refs (v0.3.1 → v0.5.0) in the same PRs that left every + # `# main`-commented osv-scan pin untouched. Keep the comment a real tag. + uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@07cab5289be65cb2ae09e7631fcc1a35bceb1ad4 # v0.1.0