Repository navigation
markets ingress pins ci-failure-analyst by bare commit SHA (DEFECTIVE PIN): move it to a channel once stable is no longer frozen #2176
Description
Problem
markets' collapsed agent-ingress.yml pins the CI Failure Analyst reusable to a bare commit SHA, ci-failure-analyst-reusable.yml@b58510275dd1cbbd13c0733c15265d51fd63b992 (comment # main), carrying a # DEFECTIVE PIN marker. A frozen SHA is outside the ring-promotion model (ADR-0002): a fix to the reusable cannot reach markets without a hand edit, and the only thing moving the pin today is Dependabot (e390f85, 2026-10-06, 79747178… → b5851027…). The pin was preserved as-is in the pilot on purpose, so the collapse stayed attributable (package §5b); this issue is the planned follow-up.
Why this is not a one-line repoint
A channel tag already exists, ci-failure-analyst/v1-stable, but combsmith/.github#1270 shows it has been frozen at v1.0.0 since 2026-07-10 (next is at about v1.46). Repointing markets to v1-stable today would move it back months. The pin cannot sensibly move until the channel does.
Required
- After .github#1270 is resolved (stable advances), repoint the
ci-failure-analystjob in markets' ingress from the bare SHA toci-failure-analyst/v1-stable(or the currentv<MAJOR>-stable), and remove the# DEFECTIVE PINmarker. - Make sure Dependabot does not fight the channel pin, and that the fleet repin tooling can find and rewrite a
uses:inside an ingress job (the pin no longer lives in a per-role stub file; see also the comment on Fleet pr-review callers pin legacy bare pr-review/stable and are unmanaged — no pr-review release can reach the fleet .github#1125 for the same point onpr-review/stable). - Update the package (see Sync the markets collapse package §3/§4b to the deployed ingress (pr-auto-review group + ci-failure-analyst pin) #2171) and the markets PR/ADR notes that call this pin defective.
Activity
github-actions commentedon Oct 10, 2026
Thanks for filing this, and for laying out the dependency on combsmith/.github#1270 so clearly. Since the repoint is blocked until the
ci-failure-analyst/v1-stablechannel advances past v1.0.0, what's your preferred way to track that? For example, should this issue stay open as a blocked follow-up, or should we add a concrete trigger such as a specific stable version that lets us start the repoint?ci(ingress): pin ci-failure-analyst to v1-stable and fix the self-tri…
don-petry commentedon Oct 12, 2026
Status update after combsmith/markets#523 (merged as
9310b6e).Required 1: done, by maintainer decision. markets' ingress
ci-failure-analystjob now pinsci-failure-analyst-reusable.yml@ci-failure-analyst/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref, and the# DEFECTIVE PINmarker is gone.The maintainer chose
v1-stableknowing it still resolves tocc0bc61while combsmith/.github#1270 holds stable back. markets has therefore moved from amainSHA (b585102) to the stable channel. It will pick up later fixes when that channel advances, without a hand edit.The canonical template, combsmith/.github#1316, carries the identical block (block SHA
4368213cf1825f4ff9c936b2a9340e95805a1acf). Fleet remediation will therefore treat this pin as the canonical value, not as drift.Required 3: moved to #2316. That covers the package §3/§4a/§5b sync, the fixture, and the re-snapshot of the pinned reusable at
v1-stable.Required 2 is still open. Two parts remain: confirming that Dependabot leaves the channel ref alone, and confirming that the fleet repin tooling can find and rewrite a
uses:inside an ingress job. This issue stays open for that.Generated by Claude Code