From 930e77129f1e6bef9c4172fde31ff46a91121eea Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 4 Aug 2026 00:06:42 +0000 Subject: [PATCH] ci: adopt the org Dependabot config (ci-workflows#10) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Keeps every action SHA pin current via Dependabot's github-actions ecosystem, grouped into one PR per cycle — including the shared osv-scan lane's pin, which Dependabot resolves via ci-workflows' release tags (release-tag.yml). The Monday caller-pins census in ci-workflows verifies convergence independently. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_017RMKHpGXzw9Zkv49fzVssg --- .github/dependabot.yml | 64 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..0376284 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,64 @@ +# Keep every action pin current — including the shared osv-scan lane's. +# +# DESTINATION: .github/dependabot.yml — NOT .github/workflows/. This is repo +# configuration, not a workflow. +# +# WHY DEPENDABOT AND NOT A BESPOKE RE-PIN BOT (ci-workflows#10) +# ------------------------------------------------------------- +# A caller's `uses: ...@` resolves the reusable workflow AT THAT COMMIT, so +# a stale pin means the repo runs an old scanner with old rules. The 2026-08-03 +# census (caller-pins.yml) measured 43 of 58 callers behind the template, and +# nothing makes a stale caller go red on its own. +# +# The fix decomposes the way OpenTofu does: the template is the DESIRED STATE, +# the caller-pins census is the PLAN (an ancestry diff of actual vs desired), +# and something has to be the APPLY. Dependabot's `github-actions` ecosystem is +# that applier, chosen over a broker-credentialed bot because: +# +# - the engine is GitHub-maintained — nothing bespoke to keep working; +# - no new credential: a custom actor would need org-wide contents:write PLUS +# the `workflows` permission (GitHub rejects workflow-file pushes without +# it), minted from a broker entry that would make ci-workflows' main able to +# reach every repo's contents — a posture change SHA pins exist to avoid; +# - it covers consumers the census cannot see: repos that call the lane from +# inside a combined workflow (infra's _infra-test.yml) rather than a +# byte-identical deps.yml, and every OTHER action pin (checkout, +# setup-node, setup-deno) going stale the same way. +# +# Dependabot converges callers onto each referenced repo's LATEST TAG — not its +# default-branch head. An untagged repo is invisible to it: guest-room ran this +# exact ecosystem weekly since June and its group PR bumped checkout/codeql pins +# while leaving the osv-scan pin three template moves behind, because +# ci-workflows had no tags. release-tag.yml now mints one per lane change, +# which is the piece of state that makes this config able to act on the lane +# pin at all. The census stays on as the independent verifier — Dependabot +# proposes, a human merges, the Monday census proves. Once the fleet reads +# current, flip caller-pins' `fail-on-lag` to true: plan must be empty. +# +# ADOPTING THIS FILE +# ------------------ +# Repo has no .github/dependabot.yml: copy this file byte-identical. +# Repo already has one (other ecosystems — npm, cargo, pip): APPEND the single +# `github-actions` entry below to its `updates:` list instead. Byte-identity is +# the norm, not a law; a merged config is correct, a clobbered one is not. +# +# The `ci` commit-message prefix is load-bearing: semantic-PR gates in this org +# reject `deps:` (claude-box did, during the rollout), and `ci:` is the accurate +# conventional-commit type for CI configuration. +# +# The single `actions` group collapses each week's bumps into ONE PR per repo — +# 58 repos on a weekly schedule is otherwise a noise machine nobody reads, +# which is the required-baseline.yml failure with extra steps. +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + groups: + actions: + patterns: + - "*" + commit-message: + prefix: "ci"