chore: track pinned action SHAs with a dependabot config - #255
Merged
Conversation
No automated process tracked the repository's SHA-pinned GitHub Actions. Add .github/dependabot.yml covering the sole detected ecosystem (github-actions) with a weekly schedule, a 7-day cooldown, and grouped updates, per the shape $restock's audit expects (skills/restock/SKILL.md, backed by ADR 0012). Bump the plugin version per ADR 0022. Fixes #236
…onfig-236 # Conflicts: # .claude-plugin/plugin.json
…onfig-236 # Conflicts: # .claude-plugin/plugin.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #236
The repository pins four GitHub Actions by full SHA across its two workflows —
actions/checkoutv7.0.1,actions/upload-pages-artifactv5.0.0,actions/deploy-pagesv5.0.0 andactions/setup-nodev7.0.0 — and nothingwatched them. There was no
.github/dependabot.ymlat all, so a pinned SHAgoing stale, or an upstream advisory against a pinned revision, would have been
noticed only by someone reading the workflow files by hand.
What this adds
One
updatesentry forgithub-actionsatdirectory: "/".That is the complete set. This repository has no
package.json,Cargo.toml,pyproject.tomlorrequirements.txt, sogithub-actionsis the onlyecosystem present and a second entry would describe nothing.
The shape is not invented here
$restockalready specifies what adependabot.ymlin this repository mustsatisfy —
skills/restock/SKILL.md:168-214, underdocs/adr/0012-restock-composes-shared-workflow-contracts.md(Accepted2026-08-13). It verifies five conditions and carries the per-entry template
verbatim. This file meets all five:
github-actionsentryuvnotpipwhere bothpyproject.tomlanduv.lockexistschedule.interval: "weekly"cooldown.default-days: 7groupswithpatterns: ["*"]github-actions-dependenciesThe cooldown is the condition worth naming: without it, dependabot re-opens
rapidly after a pull request is closed or merged, and the queue fills with
re-attempts.
$restockalso prescribes a branch name, a commit message and its owngh pr createinvocation. Those belong to its standalone flow and aredeliberately not followed here — this change came through
$quest, whosebranch convention governs. Only the five conditions and the entry template were
taken.
Verification
just verifyrun bare, exit 0, includingjust actions-check(actionlint andzizmor) and
just plugin-check. The managed pre-push hook re-ran the wholesuite in its isolated worktree on push, green.
The base-branch workflow runs this merge would trigger are not covered by that
evidence. Whether dependabot then opens sensible pull requests is likewise
unverified here — that is observable only after the first scheduled run.