From b22d701c5f2ea39d743a3b56486169463267e879 Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Thu, 17 Sep 2026 10:43:22 -0700 Subject: [PATCH] ci: float reusable-workflow refs so fleet fixes can reach this repo Replaces immutable pins on smartwatermelon/github-workflows reusable workflows with the floating tags they already correspond to: @v3.2.1 / @v3.1.1 / @688e0288... -> @v3 @054f2f7f... -> @dependabot-auto-merge-v2 No behaviour change at merge time for auto-merge: @dependabot-auto-merge-v2 points at 054f2f7f today, so that ref is byte-equivalent. Refs moving to @v3 go from 688e0288 to e6e2643, which is two claude-code-action SHA bumps (1.0.193 -> 1.0.219) with no logic change; both bumped steps already carry continue-on-error: true. That move was exercised green on smartwatermelon/swift-progress-indicator#31 and again on nightowlstudiollc/financial-agent#187, both through claude-blocking-review.yml. claude-assistant.yml takes the same bump but only fires on @claude mentions, so it is unexercised -- same action, same bump, low risk, but not verified. Why this matters: an immutable ref cannot carry a fix published after it was cut. When GHSA-8q5r-mmjf-575q was patched upstream, the fix reached consumers by repointing one tag, and the repos pinned to an exact version silently received nothing. Floating first-party refs is sanctioned policy -- github-workflows/zizmor.yml:45-54 grants smartwatermelon/github-workflows/*: ref-pin while keeping "*": hash-pin for third-party actions. Any stale trailing comment is dropped with the pin it annotated. A comment is not a pin, and several had already drifted from the SHA beside them. Verified: zizmor clean on every changed file against the fleet policy. Claude-Session: https://claude.ai/code/session_01PTUKVrdfDTU3ZH149e9pTY --- .github/workflows/claude-blocking-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claude-blocking-review.yml b/.github/workflows/claude-blocking-review.yml index fb4d57f..978bc8f 100644 --- a/.github/workflows/claude-blocking-review.yml +++ b/.github/workflows/claude-blocking-review.yml @@ -20,7 +20,7 @@ jobs: # still runs and reports a real PASS. See # smartwatermelon/github-workflows#115/#117. claude-review: - uses: smartwatermelon/github-workflows/.github/workflows/claude-blocking-review.yml@v3.1.1 + uses: smartwatermelon/github-workflows/.github/workflows/claude-blocking-review.yml@v3 with: pr_number: ${{ github.event.pull_request.number }} # Repo-specific review criteria carried over from the previous