chore(ci): every first-party ref runs the v9.0.0 composite - #15
Merged
Conversation
The nine self-pins still resolved to ci-v3.0.0, whose tree carries setup-uv v8.3.2 — so python-gate, python-publish and security-audit all executed the old version while ci.yml ran v9.0.0. Bumping the composite in #14 fixed the file; nothing that calls it moved until now. Comments move with the SHAs. A stale version comment is what zizmor's ref-version-mismatch fails on, and it turned main red this morning. Verified: 9 pins before, 0 remaining at 2a575cd after — asserted, not assumed. zizmor exit 0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015o7tjWLFZvzRv4KyNfDukx
The first-party currency guard covers examples/, not just .github/ — and it is right to. examples/ is the path consumers copy; ci-v2.0.0 got into every consumer exactly this way, because every example pointed at it while it carried nested @ci-v1 moving tags. 17 example refs moved to 33c5e5f (ci-v3.1.0). tests/security-policy.sh exits 0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#14bumped the composite. Nothing that calls it moved — all 9 first-party self-pins still resolved toci-v3.0.0, and that tree carriessetup-uvv8.3.2. Sopython-gate,python-publishandsecurity-auditwere still executing the old version.This re-points all nine at
33c5e5fa(ci-v3.1.0), moving each version comment in lockstep with its SHA.python-gate.yml:82,security-audit.yml:110,python-publish.yml:118setup-python-uvfrontend-gate.yml:91,security-audit.yml:166,cloudflare-pages-deploy.yml:195,ts-publish.yml:144setup-pnpmfrontend-gate.yml:102setup-playwrightcloudflare-pages-deploy.yml:216pages-deploy-distClaim touched
Every first-party ref executes the version its comment names.
Proof
The rewrite asserts its own completeness rather than trusting
sed: 9 pins counted before, 0 remaining at2a575cdafter, checked as a hard guard that aborts and deletes the branch on any survivor. A partial re-pin is the failure mode here — it leaves a split-brain that looks fixed.GH_TOKEN=… uvx zizmor@1.26.1 .→ exit 0, "No findings to report."Note on release ordering
ci-v3.1.0fixes the composite but its own self-pins point backwards, so it is not the tag to consume.ci-v3.2.0, cut from this merge, is what consumers should pin. Two releases rather than one is deliberate: labelling a pin with a tag it isn't is the exact defect that turnedmainred this morning.🤖 Generated with Claude Code
https://claude.ai/code/session_015o7tjWLFZvzRv4KyNfDukx