ci: replace floating branch refs with version tags and track actions via dependabot - #319
Merged
Merged
Conversation
…via dependabot Branch refs (beta, master, latest) move on every upstream push and are the largest supply chain surface in the workflows. Version tags plus weekly dependabot tracking keep updates flowing through reviewable PRs instead. claude-code-action moves from the stale beta branch to v1, which renames direct_prompt to prompt.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #319 +/- ##
==========================================
- Coverage 53.26% 47.58% -5.68%
==========================================
Files 12 13 +1
Lines 796 891 +95
==========================================
Hits 424 424
- Misses 351 446 +95
Partials 21 21
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
STRRL
marked this pull request as ready for review
July 19, 2026 22:14
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
STRRL
enabled auto-merge (squash)
July 19, 2026 22:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Four workflow references point at moving branches (
claude-code-action@betax2,helm-gh-pages@master,setup-minikube@latest). Branch refs change on every upstream push, making them the largest supply chain surface in the workflows: there is no review step between upstream pushing code and our CI executing it with repository secrets. We evaluated full SHA pinning (#312) and declined it to keep receiving upstream updates; this is the middle route.Solution
Replace branch refs with version tags, and let dependabot track all action versions weekly so updates keep arriving as reviewable PRs. Combined with the repository-level actions allowlist (configured separately in settings), workflows stay current without executing unreviewed upstream pushes.
Major Changes
anthropics/claude-code-action:@beta(stale branch, last updated Aug 2025) to@v1stable; v1 renamesdirect_prompttoprompt, migrated accordinglymedyagh/setup-minikube:@latestto@v0stefanprodan/helm-gh-pages:@masterto@v1.7.0github-actionsecosystem entry, weekly, grouped into a single PR