Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• deps: Update actions/setup-python action to v7

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• deps: Update actions/checkout digest to 3d3c42e

Detected Dependencies

github-actions (4)

.github/workflows/auto-merge.yml

.github/workflows/bootstrap-profile-repos.yml

.github/workflows/drift-check.yml (4)

• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/setup-python v6@ece7cb06caefa5fff74198d8649806c4678c61a1 → [Updates: v7]
• actions/upload-artifact v7@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• python 3.x

.github/workflows/enforce-repo-settings.yml (2)

• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]
• actions/checkout v7@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 → [Updates: v7]

renovate-config (1)

renovate.json

---

• Check this box to trigger a request for Renovate to run again on this repository

[coderabbitai]

🔗 Related PRs

#1 - feat(scripts): semantic config-drift detector + weekly CI [closed]
#2 - Add Claude Code GitHub Workflow [closed]
#14 - chore: ensure fleet repos with renovate.json are in Renovate App scope [closed]
#29 - chore: strip incident-history narration from fleet-synced templates [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

Coding Plan

Summary

• Update all four GitHub Actions dependencies to their latest major versions with SHA-pinned references for consistency and merge conflict avoidance
• Resolve the actions/github-script v7/v9 split by updating triage-bot.yml to v9
• Synchronize templates/triage-bot.yml to prevent template-workflow drift, as the drift-check system does not watch this file

Design Choices

Design Choice 1: Pinning Strategy for Updated Actions

Options Considered:

1. Update with floating major tags (e.g., @v6) and let the pinning PR normalize later
2. Update with SHA-pinned references now, preemptively aligning with the pinning PR direction

Chosen Option: 2

Rationale: SHA-pinning during update avoids merge conflicts with PR #4 and aligns with the established pattern in enforce-repo-settings.yml and pr-heal.yml.

Design Choice 2: Major Version Bump for actions/checkout (v4 → v6)

Options Considered:

1. Conservative update to v4.3.1, defer v6 until breaking changes are evaluated
2. Update directly to v6 as user-selected in the dashboard

Chosen Option: 2

Rationale: User intent is explicit via checkbox selection. v6 should be adopted with review of any breaking changes in the action's release notes.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Update Workflow Dependencies

Update all GitHub Actions dependencies to their target versions with SHA-pinned references. Group by action to ensure consistency across files.

Task 1: Update actions/checkout to v6

Update all occurrences of actions/checkout to v6 with SHA-pinning.

• Update .github/workflows/claude-code-review.yml: replace actions/checkout@v4 with SHA-pinned v6 reference
• Update .github/workflows/claude.yml: replace actions/checkout@v4 with SHA-pinned v6 reference
• Update .github/workflows/drift-check.yml: replace actions/checkout@v4 with SHA-pinned v6 reference
• Update .github/workflows/enforce-repo-settings.yml: update both occurrences from @11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 to v6 SHA with version comment
• Update .github/workflows/pr-heal.yml: update from v4.2.2 SHA to v6 SHA with version comment

Task 2: Update actions/github-script to v9 in triage-bot.yml

Resolve the v7/v9 version split by updating the remaining workflow.

• Update .github/workflows/triage-bot.yml: replace actions/github-script@v7 with SHA-pinned v9 reference matching the format in coderabbit-autofix.yml (@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9)

Task 3: Update drift-check.yml dependencies

Update the remaining rate-limited dependencies in the drift-check workflow.

• Update .github/workflows/drift-check.yml: replace actions/setup-python@v5 with SHA-pinned v6 reference
• Update .github/workflows/drift-check.yml: replace actions/upload-artifact@v4 with SHA-pinned v7 reference

🤖 Prompt for AI agents

Update GitHub Actions dependency versions across all workflow files to their
target major versions, using SHA-pinned references with inline version comments
(e.g., `@<SHA> # v6`) consistently throughout.

**actions/checkout → v6**
Resolve the correct v6 SHA from the action's release tags, then apply it in the
following files:
- `.github/workflows/claude-code-review.yml`: replace floating
`actions/checkout@v4`
- `.github/workflows/claude.yml`: replace floating `actions/checkout@v4`
- `.github/workflows/drift-check.yml`: replace floating `actions/checkout@v4`
- `.github/workflows/enforce-repo-settings.yml`: replace both occurrences of
`@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2`
- `.github/workflows/pr-heal.yml`: replace the existing v4.2.2 SHA reference

All replacements must use the format `actions/checkout@<SHA> # v6`.

**actions/github-script → v9 in triage-bot.yml**
- `.github/workflows/triage-bot.yml`: replace `actions/github-script@v7` with
SHA-pinned v9 reference
- Use the same SHA already present in `coderabbit-autofix.yml`
(`@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9`) to ensure fleet-wide
consistency — do not introduce a second distinct SHA for the same version

**actions/setup-python → v6 and actions/upload-artifact → v7 in
drift-check.yml**
- `.github/workflows/drift-check.yml`: replace `actions/setup-python@v5` with
SHA-pinned v6 reference
- `.github/workflows/drift-check.yml`: replace `actions/upload-artifact@v4` with
SHA-pinned v7 reference

All changes must follow the SHA-with-comment pattern. Do not introduce floating
tags.

Phase 2: Synchronize Template Files

Update template files to maintain consistency with workflow files. The drift-check mechanism does not enforce local template alignment, but templates serve as fleet distribution sources and must stay current.

Update templates/triage-bot.yml

Sync the template to match the updated workflow version.

• Update templates/triage-bot.yml: replace actions/github-script@v7 with SHA-pinned v9 reference (identical to .github/workflows/triage-bot.yml after Task 1.2)

🤖 Prompt for AI agents

Synchronize `templates/triage-bot.yml` to eliminate template-workflow drift for
the `actions/github-script` dependency.

- In `templates/triage-bot.yml`, replace `actions/github-script@v7` with the
identical SHA-pinned v9 reference applied to `.github/workflows/triage-bot.yml`
in Phase 1
- The resulting reference must be byte-for-byte identical to the workflow file —
no divergence in SHA or comment format
- Note: the drift-check system does not watch this file; this change must be
made explicitly and will not be caught by automated checks if omitted

Research

The repository manages GitHub Actions workflows with inconsistent dependency pinning: some files use SHA-pinned references with version comments (@SHA # v4.2.2), others use floating major tags (@v4). A critical version split exists where actions/github-script is at v9 in coderabbit-autofix.yml but remains at v7 in triage-bot.yml. The drift-check mechanism validates cross-repo consistency but does not enforce local template-to-workflow alignment. Template files serve as distribution sources for fleet repositories.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Update GitHub Actions dependency versions across all workflow files to their
target major versions, using SHA-pinned references with inline version comments
(e.g., `@<SHA> # v6`) consistently throughout.

**actions/checkout → v6**
Resolve the correct v6 SHA from the action's release tags, then apply it in the
following files:
- `.github/workflows/claude-code-review.yml`: replace floating
`actions/checkout@v4`
- `.github/workflows/claude.yml`: replace floating `actions/checkout@v4`
- `.github/workflows/drift-check.yml`: replace floating `actions/checkout@v4`
- `.github/workflows/enforce-repo-settings.yml`: replace both occurrences of
`@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2`
- `.github/workflows/pr-heal.yml`: replace the existing v4.2.2 SHA reference

All replacements must use the format `actions/checkout@<SHA> # v6`.

**actions/github-script → v9 in triage-bot.yml**
- `.github/workflows/triage-bot.yml`: replace `actions/github-script@v7` with
SHA-pinned v9 reference
- Use the same SHA already present in `coderabbit-autofix.yml`
(`@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9`) to ensure fleet-wide
consistency — do not introduce a second distinct SHA for the same version

**actions/setup-python → v6 and actions/upload-artifact → v7 in
drift-check.yml**
- `.github/workflows/drift-check.yml`: replace `actions/setup-python@v5` with
SHA-pinned v6 reference
- `.github/workflows/drift-check.yml`: replace `actions/upload-artifact@v4` with
SHA-pinned v7 reference

All changes must follow the SHA-with-comment pattern. Do not introduce floating
tags.
===============================================================================

Task: 2

Synchronize `templates/triage-bot.yml` to eliminate template-workflow drift for
the `actions/github-script` dependency.

- In `templates/triage-bot.yml`, replace `actions/github-script@v7` with the
identical SHA-pinned v9 reference applied to `.github/workflows/triage-bot.yml`
in Phase 1
- The resulting reference must be byte-for-byte identical to the workflow file —
no divergence in SHA or comment format
- Note: the drift-check system does not watch this file; this change must be
made explicitly and will not be caught by automated checks if omitted

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!