.github/actions/unplug-scan/action.yml pins two actions by mutable tag while every workflow in the repo pins the same actions by SHA.
action.yml:30 uses: astral-sh/setup-uv@v7
action.yml:37 uses: actions/setup-python@v6
Compare ci.yml:26 and ci.yml:31:
uses: astral-sh/setup-uv@20cfd1bf... # v10.0.1
uses: actions/setup-python@5fda3b95... # v7.0.0
Dependabot watches github-actions at directory: / (.github/dependabot.yml:15-16) and demonstrably updates workflows: #97 moved setup-uv 8.2.0 to 10.0.1 and #98 moved setup-python 6.3.0 to 7.0.0. It has never opened a PR touching the composite action, which is still on the pre-#97 and pre-#98 majors. So the file is both unpinned and unwatched.
This is not academic. The composite action runs in pr-scan.yml:25 on every pull request into dev, and scan is a required check.
Fix is to pin both to the SHAs the workflows already use, with the same # vX.Y.Z comment convention, and confirm dependabot picks the file up afterwards. If it still does not, the file needs its own entry rather than relying on the root watcher.
Good first issue: two lines, and the SHAs to copy are already in ci.yml.
Related: .github/workflows/integrations-live.yml:70 pins actions/checkout to 3d3c42e5aac5ba805825da76410c181273ba90b1 with the comment # v6. That SHA is v7.0.1. Every other file annotates it correctly. #99 bumped the SHA everywhere and left this one comment behind, so the comment now lies about what runs. Worth fixing in the same PR.
.github/actions/unplug-scan/action.ymlpins two actions by mutable tag while every workflow in the repo pins the same actions by SHA.Compare
ci.yml:26andci.yml:31:Dependabot watches
github-actionsatdirectory: /(.github/dependabot.yml:15-16) and demonstrably updates workflows: #97 moved setup-uv 8.2.0 to 10.0.1 and #98 moved setup-python 6.3.0 to 7.0.0. It has never opened a PR touching the composite action, which is still on the pre-#97 and pre-#98 majors. So the file is both unpinned and unwatched.This is not academic. The composite action runs in
pr-scan.yml:25on every pull request into dev, andscanis a required check.Fix is to pin both to the SHAs the workflows already use, with the same
# vX.Y.Zcomment convention, and confirm dependabot picks the file up afterwards. If it still does not, the file needs its own entry rather than relying on the root watcher.Good first issue: two lines, and the SHAs to copy are already in
ci.yml.Related:
.github/workflows/integrations-live.yml:70pinsactions/checkoutto3d3c42e5aac5ba805825da76410c181273ba90b1with the comment# v6. That SHA is v7.0.1. Every other file annotates it correctly. #99 bumped the SHA everywhere and left this one comment behind, so the comment now lies about what runs. Worth fixing in the same PR.