chore(deps): Update https://github.com/ByronWilliamsCPA/.github digest to 4b12bfe

[williaby]

Summary

Why

Scheduled patch update, bug fixes and security patches with no API changes.

Changes

This PR contains the following updates:

Package	Change	Update
https://github.com/ByronWilliamsCPA/.github	671ea6d → 4b12bfe	digest

Impact

• ✅ Patch update: bug fixes and security patches only
• ✅ No breaking changes

Acceptance Criteria

• All CI checks pass

Testing

• CI gates pass (tests, lint, type checking, security scan)

Notes

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 10pm every weekday,before 5am every weekday,every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[coderabbitai]

Warning

Review limit reached

@williaby, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 186e2b2a-4e43-4097-8b33-0377b21db31f

📥 Commits

Reviewing files that changed from the base of the PR and between 5024679 and c2a32b3.

📒 Files selected for processing (5)

• .github/workflows/qlty.yml
• .github/workflows/scorecard.yml
• .github/workflows/security-analysis.yml
• docs/reusable-workflow-jobs.yaml
• renovate.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/https-github.com-byronwilliamscpa-.github-digest

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates the pinned commit digest for the ByronWilliamsCPA/.github reusable workflows referenced by this repository, keeping the org workflow inventory in sync with the caller workflows.

Changes:

• Re-pin the ByronWilliamsCPA/.github reusable workflow references from 671ea6d... to 987d517... in the reusable workflow inventory.
• Apply the same new digest across the security analysis, Qlty coverage, and Scorecard entries.

[williaby]

PR Review

PREMISE: QUESTION — The inventory doc advances to the new digest while the three workflow callers it is meant to mirror stay at the old SHA. Renovate config blocks the caller bump, so this class of PR drifts the inventory on every digest bump.

Important — doc/caller pin drift
docs/reusable-workflow-jobs.yaml moves the recorded pin to 4b12bfe, but all three actual callers stay at 671ea6d:

• security-analysis.yml#L29
• qlty.yml#L26-L53
• scorecard.yml#L29

This creates the inventory drift the custom Renovate manager exists to prevent. Root cause is in renovate.json: packageRule[4] constrains the github-actions manager for ByronWilliamsCPA/.github to versioning: semver + followTag: v1, so it will not bump callers that SHA-pin against main. Only the custom regex manager (tracking main HEAD) fires, editing the doc alone. The custom manager's description assumes "callers Renovate already updates," but packageRule[4] blocks exactly that.

Decision needed (not a mechanical fix): either accept the doc as a "latest-main" pointer that leads the callers (and adjust the "inventory/freshness" framing), or relax packageRule[4] / repoint callers to a real v1 release so callers and doc move together.

Clean: new SHA 4b12bfe is reachable on .github main; not superseded; secrets allowlist retained (GitGuardian/Socket green); chore(deps) needs no CHANGELOG entry. renovate/stability-days is a non-blocking minimum-release-age gate.

This bot auto-rebases its branches; BEHIND state may clear without manual action.

🤖 Generated with Claude Code

[williaby]

pr-fix applied: root-cause + reconcile

Pushed c2a32b3 resolving the doc/caller drift flagged in the review.

Reconciled the drift (this PR now self-consistent):

• Bumped the 5 caller refs 671ea6d -> 4b12bfe in security-analysis.yml, qlty.yml (3), and scorecard.yml. Doc + callers + actual workflow pins now agree.

Fixed the root cause so it does not recur:

• Removed packageRules[4] (versioning: semver + followTag: v1 for ByronWilliamsCPA/.github). That rule made the github-actions manager chase a non-existent v1 tag instead of tracking the # main branch digest, so callers froze while the doc's custom regex manager advanced alone. With pinDigests: true (packageRules[2]) still active, the manager now tracks the main head and bumps callers in lockstep with the inventory.

Validation: renovate-config-validator + yamllint + detect-secrets + no-em-dash pre-commit hooks pass; confirmed against an independent model review and Renovate's github-actions manager docs (non-semver # main ref -> github-digest datasource, digest-pinning only).

Future v1 migration (preserved from the removed rule's note): once ByronWilliamsCPA/.github publishes a v1 release and callers are repointed to @<sha> # v1, re-add a github-actions packageRule matching the org .github repos to follow the v1 tag.

Note: branch is still BEHIND base. Merge is not automated (Renovate automerge disabled), so use "Update branch" before merging if you want CI to run against the merged result.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud