Skip to content

fix(ci): pin reusable-workflow @main refs to SHA in all dakota workflows - #784

Closed
castrojo wants to merge 10 commits into
mainfrom
fix/c2-pin-main-refs
Closed

fix(ci): pin reusable-workflow @main refs to SHA in all dakota workflows#784
castrojo wants to merge 10 commits into
mainfrom
fix/c2-pin-main-refs

Conversation

@castrojo

@castrojo castrojo commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Consistency audit C2: pin all @main reusable-workflow references to the current projectbluefin/actions main HEAD SHA.

Files updated:

  • .github/workflows/execute-release.yml (2 refs)
  • .github/workflows/pr-release-gate.yml (1 ref)
  • .github/workflows/promote-testing-to-main.yml (1 ref)
  • .github/workflows/release-reminder.yml (1 ref)

SHA pinned: 7f79969c2ff74c51ac7f385cb0a86414975308d7 (actions main HEAD as of 2026-06-10)

Why: Floating @main refs create non-deterministic builds — any merge to actions/main silently changes behavior for all downstream consumers without a PR. SHA pinning + Renovate ensures updates are visible and reviewed.

Renovate will keep these SHAs current going forward via the C3 grouping rule.

Closes consistency-audit C2 for dakota.

Assisted-by: Claude Sonnet 4.5 via pi

castrojo and others added 9 commits June 9, 2026 10:00
@castrojo
ci: add testing branch to build.yml PR triggers
7266c1b
@castrojo
ci: add renovate-automerge.yml to testing branch
fb4e732
@mergeraptor @castrojo @github-actions
chore(deps): update common: v2026.06-169 -> v2026.06-186 (#744)
f7d0a24 
* docs(skills): add ci.md lessons from PR 751 testing fast-forward and next stream (#752)

- Document GitHub API 422 idempotent fast-forward pattern
- Document merge-queue head_branch never equals 'main'
- Document :next/:btw as fully automated rolling stream (no human gate)

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

* chore(deps): update common: v2026.06-169 -> v2026.06-186

* ci: trigger Build Bluefin dakota on testing branch [skip build]

PR base changed to testing — re-trigger CI so renovate-automerge fires.

Assisted-by: Claude Sonnet 4.6 via pi

* ci: re-trigger CI (build.yml now includes testing branch)

Assisted-by: Claude Sonnet 4.6 via pi

---------

Co-authored-by: Jorge O. Castro <jorge.castro@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@castrojo
ci: build on push to testing branch
d0674d5 
Match bluefin-lts behavior — every Renovate/track-bst merge to testing
fires a build so testing images stay current.

Assisted-by: Claude Sonnet 4.6 via pi
@mergeraptor @github-actions
chore(deps): update common: v2026.06-186 -> v2026.06-195 (#768)
f2bd84e 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@castrojo
fix(ci): pin @main reusable-workflow refs to SHA in execute-release.yml
4915d3e 
Replaces floating `@main` references with the pinned SHA
`7f79969` (actions main HEAD) + `# v1` comment.

Renovate will keep these pinned SHAs current going forward.

Part of consistency-audit C2 — closes remaining @main refs in dakota.

Assisted-by: Claude Sonnet 4.5 via pi
@castrojo
fix(ci): pin @main reusable-workflow refs to SHA in pr-release-gate.yml
bcab54a 
Replaces floating `@main` references with the pinned SHA
`7f79969` (actions main HEAD) + `# v1` comment.

Renovate will keep these pinned SHAs current going forward.

Part of consistency-audit C2 — closes remaining @main refs in dakota.

Assisted-by: Claude Sonnet 4.5 via pi
@castrojo
fix(ci): pin @main reusable-workflow refs to SHA in promote-testing-t…
345c287 
…o-main.yml

Replaces floating `@main` references with the pinned SHA
`7f79969` (actions main HEAD) + `# v1` comment.

Renovate will keep these pinned SHAs current going forward.

Part of consistency-audit C2 — closes remaining @main refs in dakota.

Assisted-by: Claude Sonnet 4.5 via pi
@castrojo
fix(ci): pin @main reusable-workflow refs to SHA in release-reminder.yml
6a63cc9 
Replaces floating `@main` references with the pinned SHA
`7f79969` (actions main HEAD) + `# v1` comment.

Renovate will keep these pinned SHAs current going forward.

Part of consistency-audit C2 — closes remaining @main refs in dakota.

Assisted-by: Claude Sonnet 4.5 via pi
@castrojo
castrojo requested review from p5 and tulilirockz as code owners June 10, 2026 23:32
@coderabbitai

coderabbitai Bot commented Jun 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

@castrojo, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 9 minutes and 40 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 78eada76-0cce-492d-ba35-3aa5fc695748

📥 Commits

Reviewing files that changed from the base of the PR and between 5377a93 and 6663476.

📒 Files selected for processing (8)
  • .github/workflows/build.yml
  • .github/workflows/execute-release.yml
  • .github/workflows/pr-release-gate.yml
  • .github/workflows/promote-testing-to-main.yml
  • .github/workflows/release-reminder.yml
  • .github/workflows/renovate-automerge.yml
  • docs/skills/ci.md
  • elements/bluefin/common.bst
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/c2-pin-main-refs

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

This PR targets testing instead of main. Please retarget it to main — the testing branch is managed by the promotion pipeline and must not receive direct PRs.

@castrojo
castrojo changed the base branch from testing to main June 10, 2026 23:38
@github-actions

github-actions Bot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

This PR targets testing instead of main. Please retarget it to main — the testing branch is managed by the promotion pipeline and must not receive direct PRs.

@castrojo
ci: trigger CI re-run after base branch retarget
6663476 
PR was originally targeting 'testing', retargeted to 'main'.
Empty commit to trigger fresh on-pr-opened-or-updated check.

Assisted-by: Claude Sonnet 4.5 via pi
@castrojo

castrojo commented Jun 10, 2026

Copy link
Copy Markdown
Contributor Author

Replaced by a clean branch from main — see PR #786 (or next auto-opened).

@castrojo castrojo closed this Jun 10, 2026
@castrojo castrojo mentioned this pull request Jun 10, 2026
Merged
@castrojo
castrojo deleted the fix/c2-pin-main-refs branch June 23, 2026 23:47
@castrojo castrojo added 4-review A pull request is awaiting review. and removed pr/needs-review labels Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@p5 p5 Awaiting requested review from p5
@tulilirockz tulilirockz Awaiting requested review from tulilirockz

Assignees

No one assigned

Labels

4-review A pull request is awaiting review.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@castrojo