ci: track netresearch/.github reusables on @main again - #665
Merged
Conversation
`security.yml` and `auto-merge-deps.yml` were SHA-pinned and carried a trailing `# main` comment, while the sibling callers in `docker-publish.yml`, `scorecard.yml` and `codeql.yml` already track main. Org-owned reusables are referenced by `@main` so an upstream fix reaches every consumer at once; SHA-pinning is for third-party actions. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
CybotTM
force-pushed
the
ci/unpin-org-reusable
branch
from
August 3, 2026 12:25
1662ace to
5e3788f
Compare
There was a problem hiding this comment.
Pull request overview
This PR updates GitHub Actions reusable-workflow references to track the netresearch/.github org reusables on @main again (instead of a pinned full SHA), restoring the intended “central fix propagation” model and aligning with the repo’s other workflow callers.
Changes:
- Switch
security.ymlreusable workflow call from a pinned SHA to@main. - Switch
auto-merge-deps.ymlreusable workflow call from a pinned SHA to@main.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/security.yml | Updates the reusable node-audit workflow reference to @main. |
| .github/workflows/auto-merge-deps.yml | Updates the reusable auto-merge-deps workflow reference to @main. |
|
Epoche-Napoleon
pushed a commit
to Epoche-Napoleon/t3x-nr-llm
that referenced
this pull request
Aug 4, 2026
) `republish.yml` was the last caller in this repo still pinned to a tag (`@v1.3.2`). It now tracks `@main` like every other `netresearch/typo3-ci-workflows` reference here. ## Why Org-owned reusables are referenced by `@main` so an upstream fix reaches every consumer at once — that propagation is the whole point of keeping them in one repo. A pin freezes this consumer on an old copy and converts each upstream fix into a Renovate bump PR instead. That already happened: the pin landed on 2026-04-24 and [netresearch#154](netresearch#154) bumped it `v1.3.1 → v1.3.2` the next day. SHA- and tag-pinning is for **third-party** actions. It does not apply to `netresearch/*`. ## How it got there A Copilot review thread on [netresearch#140](netresearch#140) asked for pin immutability; it was applied in [netresearch#153](netresearch#153) ([cdabfeb](netresearch@cdabfeb)), which pinned both `release.yml` and `republish.yml`. `release.yml` lost its pin again as a side effect of the template adoption in [0f1114c](netresearch@0f1114cf) on 2026-06-16. `republish.yml` is not part of that template, so its pin survived. `.github/workflows/AGENTS.md` carried the "pin actions to a full SHA, not mutable tags" rule with no org-owned carve-out next to it. This PR adds that carve-out, outside the `AGENTS-GENERATED` blocks so the generator does not drop it. ## Scope check A sweep over all 191 non-archived `netresearch` repos with a default branch found 1178 `uses: netresearch/…` references across 126 repos, of which 4 were pinned. This is one of them; the other three are fixed in [retro-skill#51](netresearch/retro-skill#51) and [timetracker#665](netresearch/timetracker#665).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
security.ymlandauto-merge-deps.ymlreferencednetresearch/.githubreusables by full SHA with a trailing# maincomment — they were already meant to follow main and merely could not. They now do.Why
Org-owned reusables are referenced by
@mainso an upstream fix reaches every consumer at once. SHA-pinning is for third-party actions; applied tonetresearch/*it freezes the consumer and defeats the propagation model. Here it also left the repo inconsistent with itself: the sibling callers indocker-publish.yml,scorecard.ymlandcodeql.ymlall track@main, so only the audit and auto-merge jobs sat on an old copy.The
githubactions:S7637hotspot this leaves in SonarCloud is accepted house practice. If a quality gate blocks on it, mark the hotspot Safe rather than re-pinning.Scope
A sweep over all 191 non-archived
netresearchrepos with a default branch found 1178uses: netresearch/…references across 126 repos, of which 4 were pinned. Two of them are here; the others are being fixed int3x-nr-llmandretro-skill.