Repository navigation
chore: update action and container pins - #72377
Conversation
Refresh workflow dependencies with ./gh-aw update and regenerate compiled workflows. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
✅ Ponytail Reviewer completed successfully! Ponytail ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅
|
|
✅ PR Code Quality Reviewer completed the code quality review.
|
|
✅ Test Quality Sentinel completed test quality analysis. Test Quality SentinelOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft. Design Decision Gate 🏗️Outcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
![github-actions[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Skills-Based Review 🧠
No /tdd, /diagnosing-bugs, /codebase-design, /improve-codebase-architecture, or /grill-with-docs concerns apply here — this PR is a mechanical dependency-pin refresh with no code logic changes.
📋 Analysis
All 358 changed files fall into one of these buckets:
.github/aw/actions-lock.json,pkg/actionpins/data/action_pins.json,pkg/workflow/data/action_pins.json: version/sha bumps foractions/setup-java(v6.0.1→v6.1.0),actions/setup-python(v7.0.0→v7.1.0), and theghcr.io/github/gh-aw-nodecontainer digest refresh. These three files are kept in sync by design and the diffs match exactly, as expected.- 349
.lock.ymlfiles: generated output frommake recompile, propagating the digest/version bumps above. No hand-authored content. - A handful of
.mdsource workflows (agentic-token-audit.md,agentic-token-trend-audit.md,daily-ambient-context-optimizer.md,daily-geo-optimizer.md,daily-work-queue-formal-verification.md): single-lineuses:version bumps, matching the new pins. ponytail-reviewer.md: bumps theponytail-reviewskill pin to a new commit SHA.
No workflow intent, prompt body, trigger, or permission scope changed. The PR description documents the validation (make recompile, make agent-report-progress) and is consistent with the diff.
One item worth a quick sanity check before merge (not blocking): confirm the new DietrichGebert/ponytail/skills/ponytail-review@09c434ab... commit is from the expected upstream branch/tag, since skill pins are a supply-chain trust boundary similar to action SHAs — but this is routine for a pin-refresh PR and the author already validated compilation.
Positive Highlights
- ✅ Clean, auditable 1:1 diff between the two
action_pins.jsoncopies andactions-lock.json— no drift. - ✅ PR description clearly documents validation steps and flags the upstream workflows that were skipped.
Approving — no actionable issues found.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · ~18 AIC · ⌖ ~18 AIC · ⊞ 10.2K
Comment /matt to run again
There was a problem hiding this comment.
🟡 Changes recommended
The reviewer skill conflicts with the workflow’s scope and output requirements, and the Python action bump bypasses the required upstream refresh for a source-managed workflow.
2 open issues
What changed in this PR
Refreshes gh-aw’s workflow dependencies and synchronizes the compiler’s embedded pins with generated GitHub Actions locks.
Changes:
- Updates setup-java to v6.1.0 and setup-python to v7.1.0.
- Refreshes the Node container digest and Ponytail review skill revision.
- Synchronizes pin catalogs and regenerates workflow locks to propagate dependency updates.
| File | Description |
|---|---|
pkg/workflow/data/action_pins.json |
Synchronizes compiler action and container pins. |
pkg/actionpins/data/action_pins.json |
Synchronizes shared action and container pins. |
.github/workflows/smoke-pi-routed.lock.yml |
Propagates the Node digest into routed Pi execution. |
.github/workflows/smoke-pi-routed-claude.lock.yml |
Propagates the Node digest into Claude-routed Pi execution. |
.github/workflows/smoke-pi-auto.lock.yml |
Refreshes the auto-model Pi smoke-test container. |
.github/workflows/smoke-github-codex.lock.yml |
Refreshes the GitHub Codex smoke-test container. |
.github/workflows/smoke-copilot-sdk-routed.lock.yml |
Refreshes the routed Copilot SDK container. |
.github/workflows/smoke-copilot-sdk-routed-claude.lock.yml |
Refreshes the Claude-routed Copilot SDK container. |
.github/workflows/smoke-copilot-routed.lock.yml |
Refreshes the routed Copilot container. |
.github/workflows/smoke-copilot-routed-steering.lock.yml |
Refreshes the routed steering smoke-test container. |
.github/workflows/smoke-copilot-routed-claude.lock.yml |
Refreshes the Claude-routed Copilot container. |
.github/workflows/smoke-codex-routed.lock.yml |
Refreshes the routed Codex container. |
.github/workflows/smoke-codex-bare-auto.lock.yml |
Refreshes the bare auto-model Codex container. |
.github/workflows/smoke-codex-auto.lock.yml |
Refreshes the auto-model Codex container. |
.github/workflows/smoke-azure-pi.lock.yml |
Refreshes the Azure Pi smoke-test container. |
.github/workflows/smoke-azure-codex.lock.yml |
Refreshes the Azure Codex smoke-test container. |
.github/workflows/schema-feature-coverage.lock.yml |
Updates the coverage workflow’s Node container references. |
.github/workflows/ponytail-reviewer.md |
Advances the external review skill pin. |
.github/workflows/issue-triage-agent.lock.yml |
Updates the triage agent’s Node container references. |
.github/workflows/issue-arborist.lock.yml |
Updates the issue arborist’s Node container references. |
.github/workflows/github-remote-mcp-auth-test.lock.yml |
Refreshes the authentication test’s Node container. |
.github/workflows/dev.lock.yml |
Refreshes the development smoke-test container. |
.github/workflows/daily-work-queue-formal-verification.md |
Upgrades the Java setup action. |
.github/workflows/daily-github-docs-seo-optimizer.lock.yml |
Refreshes the SEO optimizer’s Node container. |
.github/workflows/daily-geo-optimizer.md |
Upgrades the Python setup action. |
.github/workflows/daily-ambient-context-optimizer.md |
Upgrades the Python setup action. |
.github/workflows/copilot-pr-merged-report.lock.yml |
Refreshes the reporting workflow’s Node container. |
.github/workflows/codex-github-remote-mcp-test.lock.yml |
Refreshes the remote MCP test’s Node container. |
.github/workflows/auto-triage-issues.lock.yml |
Refreshes the automated triage workflow’s Node container. |
.github/workflows/agentic-token-trend-audit.md |
Upgrades the Python setup action. |
.github/workflows/agentic-token-audit.md |
Upgrades the Python setup action. |
.github/aw/actions-lock.json |
Synchronizes repository action and container pins. |
Review effort: Max
| steps: | ||
| - name: Setup Python | ||
| uses: actions/setup-python@v7.0.0 | ||
| uses: actions/setup-python@v7.1.0 |
| @@ -34,7 +34,7 @@ imports: | |||
| - shared/otlp.md | |||
| - shared/pr-diff-data-fetch.md | |||
| skills: | |||
| - DietrichGebert/ponytail/skills/ponytail-review@2ed6c52c9d7e5e56942508591085fd45dea277d3 | |||
| - DietrichGebert/ponytail/skills/ponytail-review@09c434ab73ca43761c5d8b0c5d341926c2fba710 | |||
|
🎉 This pull request is included in a new release. Release: |
Refresh workflow dependencies using
./gh-aw updateto pick up available action, skill, and container updates.actions/setup-javato v6.1.0 andactions/setup-pythonto v7.1.0.Three upstream workflow refreshes were blocked by GitHub authentication/SAML restrictions. Release cooldowns were preserved, and two
actions/gh-drives-previewchecks found no releases or tags.Validation
make recompilecompiled all 349 workflows successfully.make agent-report-progresspassed, including impacted tests and workflow drift checks.