Repository navigation
ci(VSY-235): Six vsys CI differences from the template carry no reason: restore or comment each, pin comments, Dependabot for actions - #603
Conversation
The kendex install and mirror steps get the template's time limits and shell, and the credential scan step takes the template's name. The commits that introduced those differences (60b2420, 6b63855) state no reason for them. Each setup-bun pin names its version, v2.2.0, whose tag points at the pinned commit; the pin does not move. Dependabot now opens update pull requests for action pins. [no-changelog]
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟢 Approved
The changes match the documented template, with only a non-blocking regression-test suggestion.
1 open finding
What changed in this PR
Restores CI workflow parity with the shared template and enables automated GitHub Actions dependency updates.
Changes:
- Adds prerequisite-step timeouts and explicit shell configuration.
- Documents pinned setup-bun versions and standardizes the credential-scan name.
- Adds weekly Dependabot updates for GitHub Actions.
| File | Description |
|---|---|
.github/workflows/ci.yml |
Aligns CI steps with the template. |
.github/workflows/release.yml |
Documents the setup-bun pin version. |
.github/dependabot.yml |
Enables weekly action updates. |
🧠 Review effort: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Address PR comments
![vanillagreen-overseer[bot]](https://avatars.githubusercontent.com/u/960140?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overseer approval of head 5a122f2: cross-model second opinion pass (0 findings), Copilot approved this head, no open thread, review-replies pass.
Completed Issues
Recommendations ProcessedFixed in PR
Fix rounds: 1 | internal review (reviewer-correctness, reviewer-security) pass with 0 findings; one Copilot thread fixed and resolved; CI pass on 5a122f2 |
Summary
.github/workflows/ci.yml: thekendexinstall step gets the template'stimeout-minutes: 3andshell: bash, themirrorstep getstimeout-minutes: 5, and the credential scan step takes the template namesecrets (credential scan of the pull request diff). The commits that added these differences (60b2420, 6b63855) state no reason, so each returns to the template form..github/workflows/ci.ymland.github/workflows/release.yml: eachoven-sh/setup-bunSHA pin gets a trailing# v2.2.0comment. The pin is the commit of thev2.2.0tag and did not move..github/dependabot.yml: new, with thegithub-actionsentry exactly as.agents/skills/harness-ci/references/wiring.md§ Action pinning gives it.The differences VSY-234 commented (checkout SHA pins, default-branch aggregate helper, changes timeout) are unchanged. No file under
.agents/changes.Done-when map
shell: bashandtimeout-minutes: 3, mirror steptimeout-minutes: 5:.github/workflows/ci.yml.github/workflows/ci.yml.github/workflows/ci.yml,.github/workflows/release.ymlgithub-actionsentry:.github/dependabot.ymlpython3 scripts/ci.pypasses: validated locally on 570b173Completed Issues
Merge decision
Head
5a122f2ebfb52b028472e93ec6135a122c4314fa(cleared by the overseer), merged as bmethod with--expected-head: exit 75,merge-route: queue cause=no-bypass ruleset=22505938 bypass=never.Test Plan
python3 scripts/ci.py: pass (full, 125 s) on 570b173 and (full, 104 s) on 5a122f2.scripts/ci_workflow_test.py::check_wiringasserts the new kendex and mirror step bounds, with three must-fail controls.origin/main: clean, 3 files.scripts/ci_workflow_test.pyreads thekendexandmirrorsteps byid:and still passes.