From 2359b41cba14bb4aa1c0db71f474e4e25387660d Mon Sep 17 00:00:00 2001 From: "sadrbot[bot]" <346629323+sadrbot[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:28:09 +0000 Subject: [PATCH 1/5] sadr: date the pins check test at the fixed test time test_main_exit_codes_and_json_before_subcommand runs pins.main, which dates each release against the wall clock. The fixture release actions/fresh v1.2.0 from 2026-10-20 cleared the 7-day window on 2026-10-27, so the test fails on main from that day on. The test now patches _gh.now to the shared NOW, as test_lockage.py does. Signed-off-by: sadrbot[bot] <346629323+sadrbot[bot]@users.noreply.github.com> --- tests/test_pins.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_pins.py b/tests/test_pins.py index 2f007a3..61b60a5 100644 --- a/tests/test_pins.py +++ b/tests/test_pins.py @@ -208,12 +208,12 @@ def test_resolver_caches_tags(self): self.assertEqual(len(api.calls), 2) def test_main_exit_codes_and_json_before_subcommand(self): - with mock.patch.object(_gh, "api", FakeApi(tag_routes())), \ + with mock.patch.object(_gh, "api", FakeApi(tag_routes())), mock.patch.object(_gh, "now", lambda: NOW), \ mock.patch.object(_registry, "Client", registry), mock.patch("sys.stdout", io.StringIO()) as out: self.assertEqual(pins.main(["check", WORKFLOW]), 1) self.assertIn("9 pins checked, 6 with problems, 0 not checked, 1 skipped.", out.getvalue()) self.assertIn("skipped, local action", out.getvalue()) - with mock.patch.object(_gh, "api", FakeApi(tag_routes())), \ + with mock.patch.object(_gh, "api", FakeApi(tag_routes())), mock.patch.object(_gh, "now", lambda: NOW), \ mock.patch.object(_registry, "Client", registry), mock.patch("sys.stdout", io.StringIO()) as out: self.assertEqual(pins.main(["--json", "check", WORKFLOW]), 1) data = json.loads(out.getvalue()) From 38c234ad479589f8fcf2451ff2093b51c127a6f9 Mon Sep 17 00:00:00 2001 From: "sadrbot[bot]" <346629323+sadrbot[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:28:10 +0000 Subject: [PATCH 2/5] sadr: test on Python 3.15.2 The CI matrix moves its newest Python from 3.15.1 to 3.15.2, released 2026-10-25. The oldest leg stays at 3.10.22, the newest 3.10 release. Signed-off-by: sadrbot[bot] <346629323+sadrbot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0c54a9e..f5aa9e9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: strategy: matrix: # The oldest and the newest Python that the scripts support. - python: ["3.10.22", "3.15.1"] + python: ["3.10.22", "3.15.2"] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: From eec2c1e223fe6a280f5a6756ae5ae3e54c158820 Mon Sep 17 00:00:00 2001 From: "sadrbot[bot]" <346629323+sadrbot[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:32:17 +0000 Subject: [PATCH 3/5] sadr: move setup-python and claude-code-action pins MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit actions/setup-python v7.0.0 → v7.1.0 (ci.yml), released 2026-10-22. It adds the optional mirror inputs and changes no input this repo sets. anthropics/claude-code-action v1.0.252 → v1.0.262 (org.yml, run.yml), released 2026-10-24. The action's inputs are unchanged. It now sets up Bun 1.4.4. Signed-off-by: sadrbot[bot] <346629323+sadrbot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- .github/workflows/org.yml | 2 +- .github/workflows/run.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f5aa9e9..2adb222 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,7 +21,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: ${{ matrix.python }} - run: python -m unittest discover tests -v diff --git a/.github/workflows/org.yml b/.github/workflows/org.yml index 38b9a6e..2df09b9 100644 --- a/.github/workflows/org.yml +++ b/.github/workflows/org.yml @@ -222,7 +222,7 @@ jobs: # The credential helper supplies fresh tokens. persist-credentials: false - - uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252 + - uses: anthropics/claude-code-action@925afb53776cf1a2b738c6bdbed37b4d4000ef13 # v1.0.262 env: SEMGREP_APP_TOKEN: ${{ secrets.semgrep_app_token }} SADR_APP_TOKEN: ${{ steps.app.outputs.app-token }} diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml index a502e92..41f6c82 100644 --- a/.github/workflows/run.yml +++ b/.github/workflows/run.yml @@ -158,7 +158,7 @@ jobs: git config --global user.name 'github-actions[bot]' git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com' - - uses: anthropics/claude-code-action@f27be6b65a4652f08a2ba3cff79114829b588967 # v1.0.252 + - uses: anthropics/claude-code-action@925afb53776cf1a2b738c6bdbed37b4d4000ef13 # v1.0.262 env: SEMGREP_APP_TOKEN: ${{ secrets.semgrep_app_token }} SADR_APP_TOKEN: ${{ steps.app.outputs.app-token }} From f51213de2ed26ac30613c87d2459889feddeb096 Mon Sep 17 00:00:00 2001 From: "sadrbot[bot]" <346629323+sadrbot[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:32:18 +0000 Subject: [PATCH 4/5] sadr: note that uv can lag setup-python on CPython patches Python 3.15.2 is in actions/python-versions since 2026-10-26, but uv 0.13.5 offers only 3.15.1. The new Known traps line says how to verify locally in that case. Signed-off-by: sadrbot[bot] <346629323+sadrbot[bot]@users.noreply.github.com> --- CHANGELOG.md | 1 + plugins/sadr/skills/sadr/references/policy.md | 1 + 2 files changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a40fc6e..fabdf6f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,6 +22,7 @@ adopter's repos. So each release lists its policy changes: - A `Sadr: off` line in the owner's `.github` repo opts out that repo only. `repos.py` leaves it out of the owner's defaults, so other repos never read it as their own. - Sadr marks its draft PRs ready. When a repo asks for drafts, Sadr waits for the PR's checks and marks it ready when they pass, and each run readies any of its drafts that turned green later. Before, its drafts stayed drafts. +- A Known traps line in policy.md says how to verify locally when `uv python install` lacks a CPython patch release that `actions/setup-python` already ships. ## v2.0.0 (2026-10-23) diff --git a/plugins/sadr/skills/sadr/references/policy.md b/plugins/sadr/skills/sadr/references/policy.md index 1362b92..b0a9e42 100644 --- a/plugins/sadr/skills/sadr/references/policy.md +++ b/plugins/sadr/skills/sadr/references/policy.md @@ -316,6 +316,7 @@ These notes are examples from earlier runs. They do not limit what Sadr handles. - Poetry 2.4 and later reads `min-release-age` in days under `[solver]` in `poetry.toml`. - A bare `requirements.txt` with pip has no usable cooldown. Move it to `pyproject.toml` with a lockfile, unless AGENTS.md says not to. - `astral-sh/setup-uv` without an exact `version:` installs the newest uv. Pin it. +- `uv python install` can lack a CPython patch release that `actions/setup-python` already ships. When it does, run the local tests on the newest patch of the same line that uv has, and say under `## Verification` which version CI runs. - When Python moves, update `.python-version`, `requires-python`, the Dockerfile, CI `python-version`, and the targets of ruff and mypy. **Go, Rust, Swift and others without a cooldown setting** From 420aaad2862f8ecfc4497a9dbfbcf6d93c2af4d4 Mon Sep 17 00:00:00 2001 From: "sadrbot[bot]" <346629323+sadrbot[bot]@users.noreply.github.com> Date: Sun, 8 Nov 2026 11:35:39 +0000 Subject: [PATCH 5/5] sadr: move claude-code-action to v1.0.266 v1.0.266 installs Claude Code 2.1.316 and changes no input that org.yml or run.yml use. It was published 2026-10-31T01:05Z, before the 7-day cutoff. Signed-off-by: sadrbot[bot] <346629323+sadrbot[bot]@users.noreply.github.com> --- .github/workflows/org.yml | 2 +- .github/workflows/run.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/org.yml b/.github/workflows/org.yml index 603b807..2d9ae03 100644 --- a/.github/workflows/org.yml +++ b/.github/workflows/org.yml @@ -222,7 +222,7 @@ jobs: # The credential helper supplies fresh tokens. persist-credentials: false - - uses: anthropics/claude-code-action@925afb53776cf1a2b738c6bdbed37b4d4000ef13 # v1.0.262 + - uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266 env: SEMGREP_APP_TOKEN: ${{ secrets.semgrep_app_token }} SADR_APP_TOKEN: ${{ steps.app.outputs.app-token }} diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml index 41f6c82..4d720f8 100644 --- a/.github/workflows/run.yml +++ b/.github/workflows/run.yml @@ -158,7 +158,7 @@ jobs: git config --global user.name 'github-actions[bot]' git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com' - - uses: anthropics/claude-code-action@925afb53776cf1a2b738c6bdbed37b4d4000ef13 # v1.0.262 + - uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266 env: SEMGREP_APP_TOKEN: ${{ secrets.semgrep_app_token }} SADR_APP_TOKEN: ${{ steps.app.outputs.app-token }}