docs(ci): record SHA-pin decision for org reusable-workflow refs - #44
Open
jdwillmsen wants to merge 1 commit into
Open
docs(ci): record SHA-pin decision for org reusable-workflow refs#44jdwillmsen wants to merge 1 commit into
jdwillmsen wants to merge 1 commit into
Conversation
Every delivery repo called this repo's reusable workflows at @main, so a merge here changed CI behaviour for every caller with no version bump anywhere. Decision: pin callers to a full commit SHA (this repo has no tagged releases, so a SHA pin is the immutable option without inventing a release process) with a dated comment, updated going forward via Renovate's existing github-actions digest tracking. Updates the section 4 finding in ci-standards.md and adds a pointer from the workflows README. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TrYLd68mqFxfDFuqnPJCy7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
uses:refs to a full commit SHA rather than@main, since this repo has no tagged releases.docs/ci-standards.mdto close out the "floating-reference finding is org-wide" item with the resolution, the update mechanism (Renovate's existinggithub-actionsdigest tracking, already batched weekly), and the accepted trade-off (no more instant org-wide propagation of a behaviour change)..github/workflows/README.md's usage examples to the pinning policy so new callers don't copy the@mainexample verbatim.Companion PRs pinning the actual caller references land in
apps,deployments,infrastructure, andplatform.Test plan
Ref: JDWLABS-448