ci: pin dependabot-automerge reusable workflow to SHA

[don-petry]

Summary

• Pins dependabot-automerge-reusable.yml reference from @v1 to its current commit SHA (ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1) per the action-pinning policy.
• The SHA was resolved via gh api repos/petry-projects/.github/git/refs/tags/v1.
• Supersedes PR ci: pin dependabot-automerge reusable workflow to SHA #118, which used an older SHA (ae9709f4…) that no longer matches the current v1 tag — please close that PR.

Closes #101

Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated workflow automation configuration reference.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR pins the dependabot-automerge-reusable.yml workflow reference in the GitHub Actions workflow from a floating @v1 tag to a specific commit SHA (@ee22b427...) to satisfy action-pinning compliance requirements, while retaining the # v1 annotation for clarity.

Changes

Workflow Reference Pinning

Layer / File(s)	Summary
Configuration .github/workflows/dependabot-automerge.yml	Reusable workflow reference jobs.dependabot-automerge.uses updated from @v1 tag to pinned commit SHA @ee22b427cbce9ecadcf2b436acb57c3adf0cb63d, addressing action-pinning compliance requirement.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related issues

• Compliance: unpinned-actions-dependabot-automerge.yml #101: Directly addresses the compliance finding for unpinned actions in dependabot-automerge.yml by replacing the @v1 tag with a pinned commit SHA.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title clearly summarizes the main change: pinning the dependabot-automerge reusable workflow to a specific commit SHA instead of using the @v1 tag.
Linked Issues check	✅ Passed	The PR successfully addresses issue #101 by pinning the dependabot-automerge reusable workflow to commit SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d, achieving compliance with the action-pinning policy.
Out of Scope Changes check	✅ Passed	All changes in the PR are directly related to the action-pinning compliance requirement. Only the reusable workflow reference was modified; no other job configurations or unrelated changes were introduced.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-101-20260420-0433

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Pins the reusable Dependabot automerge workflow reference to an immutable commit SHA to satisfy the repository’s action-pinning compliance policy.

Changes:

• Update .github/workflows/dependabot-automerge.yml to use the petry-projects/.github reusable workflow at commit ee22b427cbce9ecadcf2b436acb57c3adf0cb63d instead of the mutable v1 tag.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/dependabot-automerge.yml:
- Line 38: Update the pinned commit SHA in the workflow uses line so it matches
the current v1 tag: replace the existing SHA after
petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@
(currently ee22b427cbce9ecadcf2b436acb57c3adf0cb63d) with the correct SHA
b51e2edf830ea085be0277bcf3174c7b3ec8f958 to ensure the workflow uses the
intended v1 release.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 80ca7066-d37b-4ace-b40f-94d7467b1bf2

📥 Commits

Reviewing files that changed from the base of the PR and between 7042668 and a9bdf39.

📒 Files selected for processing (1)

• .github/workflows/dependabot-automerge.yml

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the pinned SHA matches the current v1 tag in petry-projects/.github,
# and confirm whether it is a commit SHA or an annotated-tag object SHA.

set -euo pipefail
PINNED_SHA="ee22b427cbce9ecadcf2b436acb57c3adf0cb63d"

echo "=== Resolving git/refs/tags/v1 ==="
REF_RESPONSE=$(gh api repos/petry-projects/.github/git/refs/tags/v1)
echo "$REF_RESPONSE" | jq .

REF_SHA=$(echo "$REF_RESPONSE" | jq -r '.object.sha')
REF_TYPE=$(echo "$REF_RESPONSE" | jq -r '.object.type')

echo ""
echo "=== Tag ref SHA: $REF_SHA (type: $REF_TYPE) ==="

if [ "$REF_TYPE" = "tag" ]; then
  echo "Annotated tag detected — dereferencing to commit SHA..."
  COMMIT_SHA=$(gh api "repos/petry-projects/.github/git/tags/$REF_SHA" | jq -r '.object.sha')
  echo "Underlying commit SHA: $COMMIT_SHA"
else
  COMMIT_SHA="$REF_SHA"
fi

echo ""
echo "=== Comparison ==="
echo "Pinned in workflow : $PINNED_SHA"
echo "Current commit SHA : $COMMIT_SHA"

if [ "$PINNED_SHA" = "$COMMIT_SHA" ]; then
  echo "✅ SHA matches — correctly pinned to the commit."
elif [ "$PINNED_SHA" = "$REF_SHA" ] && [ "$REF_TYPE" = "tag" ]; then
  echo "⚠️  SHA matches the tag OBJECT, not the underlying commit ($COMMIT_SHA). Consider updating to the commit SHA."
else
  echo "❌ SHA MISMATCH — workflow is pinned to a stale or incorrect SHA."
fi

Repository: petry-projects/broodly

Length of output: 759

---

Update the pinned SHA to match the current v1 tag.

The pinned SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d does not match the current v1 tag in petry-projects/.github. The v1 tag currently resolves to b51e2edf830ea085be0277bcf3174c7b3ec8f958. Update line 38 to:

    uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@b51e2edf830ea085be0277bcf3174c7b3ec8f958 # v1

The workflow is presently pinned to a stale commit and will not use the intended version.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependabot-automerge.yml at line 38, Update the pinned
commit SHA in the workflow uses line so it matches the current v1 tag: replace
the existing SHA after
petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@
(currently ee22b427cbce9ecadcf2b436acb57c3adf0cb63d) with the correct SHA
b51e2edf830ea085be0277bcf3174c7b3ec8f958 to ensure the workflow uses the
intended v1 release.

[don-petry]

@claude Please address all open review comments on this PR from CodeRabbit and Copilot.

[claude]

Claude finished @don-petry's task in 37s —— View job

---

Addressing Review Comments

• Gather context and analyze review comments
• Attempt to apply fix from CodeRabbit's critical finding
• Update final status

---

Summary

I reviewed all open review comments from CodeRabbit and Copilot:

Copilot — No actionable code changes. The Copilot comment was a high-level PR overview only.

CodeRabbit (Critical) — Identified that the pinned SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d is stale. The current v1 tag in petry-projects/.github now resolves to b51e2edf830ea085be0277bcf3174c7b3ec8f958.

Required fix in .github/workflows/dependabot-automerge.yml line 38:

# Before
uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1

# After
uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@b51e2edf830ea085be0277bcf3174c7b3ec8f958 # v1

However, I'm unable to apply this fix directly. GitHub App permissions do not allow me to modify files in the .github/workflows/ directory. You'll need to make this one-line change manually. See the FAQ for more information.

You can apply the fix locally with:

sed -i 's/ee22b427cbce9ecadcf2b436acb57c3adf0cb63d/b51e2edf830ea085be0277bcf3174c7b3ec8f958/' .github/workflows/dependabot-automerge.yml
git add .github/workflows/dependabot-automerge.yml
git commit -m "ci: update dependabot-automerge SHA to current v1 tag"
git push

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - please fix this PR

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.