Canonical issue
Narrow, self-contained slice of #1398 — the part that can be fixed without a gh CLI environment.
This issue does not cover the toolchain bump. #1398 stays open and owns that: moving the four v0.82.14 assertions to v0.84.2 and recompiling the lock files with a real gh aw compile run. That work still needs a human with the CLI.
Outcome
Dependabot stops opening github/gh-aw-actions/* PRs that cannot go green, so #1171-shaped failures stop recurring. #1398 records that #1171 has been re-triaged four times by the automated remediation loop, each run re-deriving the same diagnosis and burning a review cycle on a PR no agent can fix.
Root cause (as established in #1398)
.github/workflows/*.lock.yml are generated by gh aw compile. gh-aw-validation.yml pins that compiler and, as its last step, recompiles and runs git diff --exit-code over the generated files. Dependabot rewrites the uses: pins inside the generated artifacts without rerunning the compiler, so the recompile reverts the edit and the diff is non-empty.
From run 30993992684 (- = committed by Dependabot, + = what the pinned compiler emits):
- uses: github/gh-aw-actions/setup@fd783ac87efde5e0c0e05d593f1906ea25b5d92e # v0.84.2
+ uses: github/gh-aw-actions/setup@b6d1443e05b8716267fa19425b99aa4f12006b4a # v0.82.14
##[error]Process completed with exit code 1.
The compiler pin, not the lock file, owns that version — so a Dependabot bump of it is unmergeable by construction, not merely misconfigured.
Scope
Why the ignore costs nothing
github/gh-aw-actions/setup is referenced only by the two generated lock files and by the SHA assertion inside gh-aw-validation.yml. No hand-written workflow uses it, so Dependabot coverage of hand-written workflows is unchanged.
It also does not obstruct #1398: the upgrade path there is compiler-driven (gh aw compile), so a Dependabot proposal was never a usable input to it.
Risk
Verification
.github/dependabot.yml parses and the ignore entry resolves under the github-actions ecosystem. There is no CI job that exercises Dependabot config; GitHub validates it on push to the default branch.
Canonical issue
Narrow, self-contained slice of #1398 — the part that can be fixed without a
ghCLI environment.This issue does not cover the toolchain bump. #1398 stays open and owns that: moving the four
v0.82.14assertions tov0.84.2and recompiling the lock files with a realgh aw compilerun. That work still needs a human with the CLI.Outcome
Dependabot stops opening
github/gh-aw-actions/*PRs that cannot go green, so#1171-shaped failures stop recurring. #1398 records that #1171 has been re-triaged four times by the automated remediation loop, each run re-deriving the same diagnosis and burning a review cycle on a PR no agent can fix.Root cause (as established in #1398)
.github/workflows/*.lock.ymlare generated bygh aw compile.gh-aw-validation.ymlpins that compiler and, as its last step, recompiles and runsgit diff --exit-codeover the generated files. Dependabot rewrites theuses:pins inside the generated artifacts without rerunning the compiler, so the recompile reverts the edit and the diff is non-empty.From run 30993992684 (
-= committed by Dependabot,+= what the pinned compiler emits):The compiler pin, not the lock file, owns that version — so a Dependabot bump of it is unmergeable by construction, not merely misconfigured.
Scope
ignoreentry forgithub/gh-aw-actions/*in thegithub-actionsecosystem of.github/dependabot.yml, with the upgrade path recorded inline so the next person does not re-derive it.PR Governance"Canonical issue" failure on bot PRs (related to agent-completion/truth-gate is permanently unsatisfiable for any PR closing an[aw]issue #1130); the disposition of build(deps): bump github/gh-aw-actions/setup from 0.82.14 to 0.84.2 #1171 itself, which is a human call.Why the ignore costs nothing
github/gh-aw-actions/setupis referenced only by the two generated lock files and by the SHA assertion insidegh-aw-validation.yml. No hand-written workflow uses it, so Dependabot coverage of hand-written workflows is unchanged.It also does not obstruct #1398: the upgrade path there is compiler-driven (
gh aw compile), so a Dependabot proposal was never a usable input to it.Risk
ignoreentry; no workflow logic, no generated file, no runtime code changes.gh-aw-actionsbump is not surfaced by Dependabot. Mitigated by the inline comment and by ci: gh-aw toolchain pin is hard-coded to v0.82.14 in 4 places, making Dependabot bumps (#1171) structurally unmergeable #1398 tracking the upgrade explicitly.Verification
.github/dependabot.ymlparses and the ignore entry resolves under thegithub-actionsecosystem. There is no CI job that exercises Dependabot config; GitHub validates it on push to the default branch.