From f078b6275e86ef8842c732f7752d96e1c8cddcd6 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 5 Aug 2026 10:15:25 +0000 Subject: [PATCH] fix(ci): stop Dependabot bumping generated gh-aw lock files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `.github/workflows/*.lock.yml` are generated by `gh aw compile`, and `gh-aw-validation.yml` pins that compiler to a single version. Dependabot's github-actions ecosystem scans those generated files and rewrites the `uses:` pins inside them without rerunning the compiler, so the validation job's final `git diff --exit-code -- *.lock.yml` step regenerates them at the pinned version and fails on every such bump. PR #1171 (github/gh-aw-actions/setup 0.82.14 -> 0.84.2) is the worked example: `gh aw compile` runs clean ("Compiled 2 workflow(s): 0 error(s)") and the diff step then reports both lock files reverting `setup@fd783ac # v0.84.2` back to `setup@b6d1443 # v0.82.14`. The PR cannot go green as authored — the compiler pin, not the lock file, owns that version. `github/gh-aw-actions/setup` is referenced only by the two generated lock files and by the SHA assertion inside `gh-aw-validation.yml`, so ignoring it costs no Dependabot coverage on any hand-written workflow. The upgrade path is recorded inline: bump the version in `gh-aw-validation.yml` (extension install, version assert, and the `actions-lock.json` entry key + SHA), update `.github/aw/actions-lock.json`, then recompile and commit the regenerated lock files in one change. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_012KweRioyXT3yu5CmgEKJjM --- .github/dependabot.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d886cf5a4..9cd5344fb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -40,3 +40,23 @@ updates: directory: "/" schedule: interval: "weekly" + ignore: + # `.github/workflows/*.lock.yml` are generated by `gh aw compile`, and + # `gh-aw-validation.yml` pins that compiler to one version. Dependabot + # rewrites the `uses:` pins inside the generated files without rerunning + # the compiler, so the validation job's final + # `git diff --exit-code -- *.lock.yml` step regenerates them at the pinned + # version and always fails. PR #1171 (0.82.14 -> 0.84.2) is the worked + # example: `gh-aw Validation` red with the recompile reverting every + # bumped pin. + # + # `github/gh-aw-actions/setup` appears only in those generated files (and + # in the SHA assertion inside `gh-aw-validation.yml`), so ignoring it here + # costs no coverage on any hand-written workflow. + # + # To upgrade gh-aw, bump the version in `gh-aw-validation.yml` (extension + # install, version assert, and the `actions-lock.json` entry key + SHA), + # update `.github/aw/actions-lock.json`, then recompile with + # `gh aw compile canonical-pr-remediator focused-coverage-controller` + # and commit the regenerated lock files in the same change. + - dependency-name: "github/gh-aw-actions/*"