From 9f27c829065a07f6d31a49c1d1f3aa0972de8b61 Mon Sep 17 00:00:00 2001 From: Arena Agent Date: Sun, 25 Oct 2026 11:40:02 +0000 Subject: [PATCH] chore(ci): one pass over action pins instead of four dependency PRs Dependabot opened #287, #288, #289 and #290 within an hour of each other. Three of them move an action to the exact SHA this repository already uses elsewhere, so they are one change - 'use the version already pinned' - and merging them separately costs three serialised runs of the full suite on main (Julia tests alone is 20-35 minutes), plus a rebase of the remaining two after each merge. - actions/cache/restore and actions/cache/save 4.3.0 -> 6.1.0, the SHA actions/cache is already pinned at in six places. - actions/upload-artifact 4.6.2 -> 7.0.2, the SHA already pinned in four. - upload-sarif's comment claimed v4.38.0 and '4.38.1 blocked estate-wide', while the pinned SHA actually resolves to v4.39.0 on Dependabot's reading, so the note described a version the pin was already past. The comment now states what is true and why the SHA rather than the tag is the pin. github/codeql-action is now ignored by Dependabot: a pin that carries an estate-wide decision should be moved by hand with its comment, not silently. That leaves #290 (4.39.0 -> 4.39.1) as the owner's call rather than a bot's. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> --- .github/dependabot.yml | 8 ++++++++ .github/workflows/ci.yml | 6 +++--- .github/workflows/hypatia-scan-reusable.yml | 2 +- .github/workflows/null-calibration-comparators.yml | 6 +++--- 4 files changed, 15 insertions(+), 7 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5017e7f..3a69968 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,14 @@ updates: schedule: interval: weekly open-pull-requests-limit: 5 + ignore: + # Pinned deliberately, with the reason in a comment beside the pin. On + # 2026-10-25 Dependabot changed this pin's SHA while leaving a comment + # that said v4.38.0 / "4.38.1 blocked estate-wide" - a change nobody could + # review without resolving the SHA by hand. Action pins that carry an + # estate-wide decision are updated by hand. + - dependency-name: github/codeql-action + update-types: [version-update:semver-major, version-update:semver-minor, version-update:semver-patch] # A dependency pull request is a one-line diff that becomes stale the # moment anything else merges, and the Branch freshness check then fails it # on a rule the dependency did not break. Dependabot's default is not to diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ec5ab4e..6c4a310 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -271,7 +271,7 @@ jobs: # the restore runs as root. The run id makes each key unique so every attempt # saves its progress; restore-keys picks the newest match. - name: Restore the renv cache - uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: /opt/renv-cache key: renv-${{ runner.os }}-R${{ env.R_APT_VERSION }}-${{ hashFiles('renv.lock') }}-${{ github.run_id }} @@ -307,7 +307,7 @@ jobs: - name: Save the renv cache if: always() - uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: /opt/renv-cache key: renv-${{ runner.os }}-R${{ env.R_APT_VERSION }}-${{ hashFiles('renv.lock') }}-${{ github.run_id }} @@ -609,7 +609,7 @@ jobs: - name: Retain statistics evidence if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: statistics-standards path: | diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml index b797c2f..95d8c5e 100644 --- a/.github/workflows/hypatia-scan-reusable.yml +++ b/.github/workflows/hypatia-scan-reusable.yml @@ -671,7 +671,7 @@ jobs: # This flag only tolerates a genuine upload failure (e.g. Advanced # Security disabled on a private repo) once the job is actually running. continue-on-error: true - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100) + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 (the SHA, not the tag, is pinned: Dependabot resolves it to 4.39.0) with: sarif_file: hypatia-effective.sarif category: hypatia diff --git a/.github/workflows/null-calibration-comparators.yml b/.github/workflows/null-calibration-comparators.yml index c4e43f3..e49c20c 100644 --- a/.github/workflows/null-calibration-comparators.yml +++ b/.github/workflows/null-calibration-comparators.yml @@ -131,7 +131,7 @@ jobs: # dada2, vegan, glmGamPoi and their dependencies from source on every run, # which is most of the wall clock and none of the information. - name: Restore the renv cache - uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: /opt/renv-cache key: renv-${{ runner.os }}-R${{ env.R_APT_VERSION }}-${{ hashFiles('renv.lock') }}-${{ github.run_id }} @@ -160,7 +160,7 @@ jobs: - name: Save the renv cache if: always() - uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: /opt/renv-cache key: renv-${{ runner.os }}-R${{ env.R_APT_VERSION }}-${{ hashFiles('renv.lock') }}-${{ github.run_id }} @@ -296,7 +296,7 @@ jobs: - name: Retain the raw cells if: always() - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: null-calibration-raw path: |