From 672217300bbf244a2b0c3cff3bfada57ae68fd01 Mon Sep 17 00:00:00 2001 From: Lucas Ramos <3140800+lucas-d-ramos@users.noreply.github.com> Date: Mon, 5 Oct 2026 09:47:31 +0200 Subject: [PATCH] ci: remove the pin-override workflow It exists only to move packages of packages (re-resolve in range, move a parent, write a `resolutions` entry). Under the rule settled 2026-10-02 a transitive package is its parent's job, so the job has no purpose here. See WeMoveEU/dependency-policy README, first rule. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pin-override.yml | 175 ----------------------------- 1 file changed, 175 deletions(-) delete mode 100644 .github/workflows/pin-override.yml diff --git a/.github/workflows/pin-override.yml b/.github/workflows/pin-override.yml deleted file mode 100644 index beb85b9..0000000 --- a/.github/workflows/pin-override.yml +++ /dev/null @@ -1,175 +0,0 @@ -# Copied from WeMoveEU/dependency-policy templates/pin-override.yml — the PYTHON-ONLY -# variant: this repo has one pyproject.toml + uv.lock at the repository root and no -# package.json, so the template's node/corepack setup is replaced by setup-uv and its -# backend+frontend steps are collapsed into one step at `path: "."`. -# -# The action (ci-workflows pin-override, v14.7.0 and later) tells the two kinds of root -# apart by their lockfiles and gives a Python root the template's first pass in uv's -# dialect: pip-audit over a frozen `uv export`, then `uv lock --upgrade-package -# ''` for every package it names — capped at each package's own -# compatibility line (its major, or its minor below 1.0) — then pip-audit again, and -# anything that did not actually clear its advisory is reverted. `uv.lock` is the only -# file that moves; pyproject.toml is never edited, so a floor like `pytest>=8.3` is never -# turned into an 8 -> 9 jump a robot chose. -# -# Why this runs next to Dependabot: Dependabot's security PR is one exact version for one -# package, and once such a PR has been closed by hand it records an ignore for that -# version and never re-proposes the fix. This job instead moves every named package to -# the newest release its own line already allows — what `uv lock --upgrade-package` gives -# a person at the keyboard — and checks the result against the advisory data rather than -# trusting the version arithmetic. -# -# It opens the PR as the org's policy App and merges nothing: this repo is tier 3, so a -# person decides when it ships. The PR sits under the App's name, where the daily brief -# lists it as awaiting review. The template's `Arm auto-merge` step is deleted here on -# purpose. -# -# Action pins match the rest of the fleet. Dependabot's github-actions ecosystem keeps them -# current now that this file lives here. - -name: Dependabot pin override - -on: - schedule: - # 04:49 UTC Mon-Thu: an hour after the 03:00 Dependabot window, so the day's own PRs - # have landed and are not re-proposed, and before the 05:07 brief — anything this job - # fixes therefore never reaches the brief's UNPATCHED section, and what remains there - # is genuinely a human's to-do list. Mon-Thu because a merge here reaches production on - # tier 1/2 and the fleet does not ship on Fridays. - # - # THE MINUTE IS PER-REPO, do not copy another repo's. The fleet runs these one at a - # time inside 04:00-04:55, and the slot table lives in the template - # (dependency-policy templates/pin-override.yml): take a free minute there when adding - # a repo, and write it down there. - - cron: "49 4 * * 1-4" - workflow_dispatch: - -permissions: - contents: write - pull-requests: write - -concurrency: - group: pin-override - cancel-in-progress: true - -jobs: - override: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - # `uv` on PATH: the action runs this repo's own `uv export` / `uv lock` and fetches - # pip-audit with `uv run --with`, so nothing else is installed. An exact release, not - # a floating major: astral-sh/setup-uv publishes no `vN` tag past v7, and Dependabot - # keeps this pin current. - - uses: astral-sh/setup-uv@v10.2.0 - - - name: Override pins - id: override - uses: WeMoveEU/ci-workflows/.github/actions/pin-override@v14 - with: - path: "." - - # Step outputs reach bash through `env:`, never through ${{ }} interpolation inside - # the script, and every use is a quoted printf argument. Two reasons, and the first - # one already bit: the action emits markdown with backticks around package names, and - # interpolated backticks are COMMAND SUBSTITUTION — the first run of this job opened - # PRs whose every row read "- → (high, GHSA-...)" because bash had executed `tar` - # and `qs` and substituted their empty output. The second is that advisory text is - # third-party content flowing into a shell, an injection surface whatever it looks - # like. All prose lives in env: below for the same reason: nothing to re-quote. - - name: Collect the outcome - id: collect - env: - BUMPED: ${{ steps.override.outputs.bumped }} - BLOCKED: ${{ steps.override.outputs.blocked }} - PREAMBLE: | - Written by the `pin-override` action on a schedule. `uv.lock` only — - `pyproject.toml` is untouched. - - **Re-locked in range** means `uv lock --upgrade-package ''`: - each package pip-audit named moved to the newest release inside its own - compatibility line (its major, or its minor below 1.0), and the rest of the - lock stays pinned where it was. Dependabot proposes one exact version instead, - and stops proposing it at all once a PR for it has been closed by hand. - - Everything below was **verified by re-running `pip-audit`** over a fresh - `uv export` — anything that did not actually clear its advisory was reverted - rather than left in place. - BLOCKED_INTRO: | - Not safe to automate, with the reason: the fix is outside the package's own - compatibility line, or no fixed release exists yet. - NOTES: | - ### Review notes - - - `ci` runs the python-pins check, `uv sync --group dev` and the pytest suite - against the regenerated lock. A person merges this; six repos import this - library from an unpinned git URL, so a merge here reaches them at their next - build. - - pip-audit reads the PyPA advisory database, so it can name an advisory - before GitHub has a Dependabot alert for it; the alert, when it arrives, - closes on its own once this lands. - run: | - set -euo pipefail - { - echo "body<<__BODY__" - printf '%s\n' "$PREAMBLE" - if [ -n "$BUMPED" ]; then - printf 'Re-locked in range:\n%s\n\n' "$BUMPED" - fi - printf '### Left for a human\n\n' - if [ -n "$BLOCKED" ]; then - printf '%s\n' "$BLOCKED_INTRO" - printf '%s\n\n' "$BLOCKED" - else - printf 'Nothing.\n\n' - fi - printf '%s\n' "$NOTES" - echo "__BODY__" - } >> "$GITHUB_OUTPUT" - - # THE PR IS OPENED AS THE ORG'S POLICY APP, not as a person. - # - # Two things have to be true of this credential. The PR must arrive with checks — - # installing from the regenerated `uv.lock` is what validates what this job writes. - # And the PR must not look like a human wrote it: GitHub notifies nobody about their - # own PR, and the daily brief selects on the author, so a PR under a person's name is - # invisible to everyone. Sixteen sat that way across the fleet on 2026-09-18, one for - # four days. - # - # The App does both. This chain ran on a PAT from 2026-09-09 to 2026-09-18 because an - # App-opened PR appeared to arrive with "no checks reported" (wemove-charity.eu#87). - # That was a misread of a slow queue: the run existed (34359897268 — `pull_request`, - # actor dependabot-global-policies[bot], created 13:52:28Z) and the PR was closed as - # check-less at 13:52:49Z, twenty seconds after the run started. GitHub's recursion - # guard applies to GITHUB_TOKEN only; an installation token starts workflows like any - # user, which is also why merges armed with it fire the deploy push (see - # dependency-policy README). - # - # The App is installed on every repo and the secrets are org-level, so unlike the - # fine-grained PAT there is no per-repo list to forget (the 403 that hit fundraiser-api - # on 2026-09-10). `author`/`committer` are set to the App's bot user explicitly: - # create-pull-request otherwise attributes the commit to `github.actor`, which on a - # schedule is whoever last touched this file. - - name: Mint App token - id: app - if: steps.override.outputs.changed == 'true' - uses: actions/create-github-app-token@v3 - with: - app-id: ${{ secrets.DEPENDABOT_POLICY_APP_ID }} - private-key: ${{ secrets.DEPENDABOT_POLICY_APP_KEY }} - - - name: Open PR - id: pr - if: steps.override.outputs.changed == 'true' - uses: peter-evans/create-pull-request@v8 - with: - token: ${{ steps.app.outputs.token }} - author: dependabot-global-policies[bot] <319052427+dependabot-global-policies[bot]@users.noreply.github.com> - committer: dependabot-global-policies[bot] <319052427+dependabot-global-policies[bot]@users.noreply.github.com> - branch: chore/pin-override - delete-branch: true - add-paths: | - uv.lock - commit-message: "fix(deps): re-lock the advisories Dependabot cannot move" - title: "fix(deps): re-lock the advisories Dependabot cannot move" - body: ${{ steps.collect.outputs.body }}