From f942b7d2bfa4df249d847c46fc7f7922087961b5 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Tue, 15 Sep 2026 04:31:34 +0500 Subject: [PATCH 1/2] chore(ci): pin reusable workflows to current module mains Point callers at ci-workflows 9eb9e07 and github-actions 6064b7d. Dependabot PRs targeting a624689/c113d4c would regress extra-approval. Co-authored-by: Cursor --- .gds/repository.yaml | 2 +- .github/workflows/ci-feedback-events.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/gds-ci.yml | 4 ++-- .../golden/projections/control-plane/.claude/CLAUDE.md | 2 +- .../projections/control-plane/.gds/bundle.lock.yaml | 10 +++++----- .../control-plane/.github/workflows/gds-ci.yml | 8 ++++---- tests/golden/projections/control-plane/AGENTS.md | 2 +- 8 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.gds/repository.yaml b/.gds/repository.yaml index bc4d27e..2184137 100644 --- a/.gds/repository.yaml +++ b/.gds/repository.yaml @@ -81,7 +81,7 @@ ci: build_command: "go build -trimpath ./core/cmd/gds" test_command: "go test ./..." timeout_minutes: 30 - workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7" + workflow_ref: "NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7" # A public repository, so GitHub-hosted runners are unmetered and a fork's # pull request cannot reach anything of ours. Self-hosted hardware here would # turn a fork PR into remote code execution on it. diff --git a/.github/workflows/ci-feedback-events.yml b/.github/workflows/ci-feedback-events.yml index 9a86e19..1d18c41 100644 --- a/.github/workflows/ci-feedback-events.yml +++ b/.github/workflows/ci-feedback-events.yml @@ -19,7 +19,7 @@ jobs: permissions: actions: read # Read exact completed run and job metadata. issues: write # Publish bounded failure evidence in this repository. - uses: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml@c078ddcbcfb771f56a334184b7b6399cfd9c39c4 # commit:c078ddcbcfb771f56a334184b7b6399cfd9c39c4 + uses: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml@6064b7d98a4e6b852de7572de12b8889e8fbfe38 # commit:6064b7d98a4e6b852de7572de12b8889e8fbfe38 with: run-id: ${{ format('{0}', github.event.workflow_run.id) }} run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9c0689e..4dee195 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,7 +31,7 @@ jobs: actions: read contents: read security-events: write - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@bc9c7919de1c39d947a8709a92856925051bae05 # commit:bc9c7919de1c39d947a8709a92856925051bae05 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 with: # Public repository: `pull_request` runs untrusted fork code. Name the # hosted runner explicitly — the reusable's default belongs to the pinned diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml index 2938651..49361d4 100644 --- a/.github/workflows/gds-ci.yml +++ b/.github/workflows/gds-ci.yml @@ -34,7 +34,7 @@ jobs: name: GDS fast permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 with: fetch_depth: 0 # Public hosted CI uses GitHub's service cache; the pinned reusable @@ -54,7 +54,7 @@ jobs: needs: fast permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 with: fetch_depth: 0 cache: true diff --git a/tests/golden/projections/control-plane/.claude/CLAUDE.md b/tests/golden/projections/control-plane/.claude/CLAUDE.md index edbd470..8b54cb1 100644 --- a/tests/golden/projections/control-plane/.claude/CLAUDE.md +++ b/tests/golden/projections/control-plane/.claude/CLAUDE.md @@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY generator: gds bundle: 0.9.4-dev source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001 -input-digest: sha256:e9687bc6603c6252585736cc1745c9096de32cf97fca37ac0f1d8b8859135ca4 +input-digest: sha256:c2fad19143a9132f67605c3ba10775dc1e4e0e9fa1a06f335f7ce4891a02aba5 output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665 edit-source: - .gds/repository.yaml diff --git a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml index b36e683..4b9326f 100644 --- a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml +++ b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml @@ -9,14 +9,14 @@ bundle: digest: "sha256:10ac7ebfa7ab684a862bc94b56fe7b5088b1c3e8331f0ada387567d7270a60a7" projection: - input_digest: "sha256:e9687bc6603c6252585736cc1745c9096de32cf97fca37ac0f1d8b8859135ca4" - output_digest: "sha256:563472d67819dcafcb39d465411ec47d6f9ad690210ba4cbaa066a9f2f3486d1" + input_digest: "sha256:c2fad19143a9132f67605c3ba10775dc1e4e0e9fa1a06f335f7ce4891a02aba5" + output_digest: "sha256:1306eaf3160de36e18996ae43c959c668117eaea95af65f7f2c72e18f99e399a" files: - path: ".claude/CLAUDE.md" - digest: "sha256:b113bc39249e78ec4ca3c4256aa450b81e6f8a578f1e8e40db55968d888512e1" + digest: "sha256:7d99813f9897ec6edc73518052cb2fb95316f0facdd4ebab6c5cb473c9072ae8" - path: ".gds/compiled-policy.json" digest: "sha256:0cbdf7a659e32c65f3c41a630fc1541e84c94f259cf86200992e1cc711da80c7" - path: ".github/workflows/gds-ci.yml" - digest: "sha256:1c94eab39ab7aaa209b5ac40a303afa7082169ae02d52caeaca60570d0cac6fd" + digest: "sha256:73403d1988bcd42be9b8fbdc0a98702163c20f423c6237702c578810926f845f" - path: "AGENTS.md" - digest: "sha256:7193b538c7196ee6fd5dde68ae25fd8153ecba4260471cf5b9e1e0aa542ee645" + digest: "sha256:4b4fa18e8c85c6570820df7dfc8c956a1ed8df246ce9a89b00f9c62e4fa31f98" diff --git a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml index 3a86d00..f15681d 100644 --- a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml +++ b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml @@ -2,8 +2,8 @@ # generator: gds # bundle: 0.9.4-dev # source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001 -# input-digest: sha256:e9687bc6603c6252585736cc1745c9096de32cf97fca37ac0f1d8b8859135ca4 -# output-digest: sha256:15b87303cd0692fd8e5d88281771dded9fdc2fc027d600681155cb4e71f42386 +# input-digest: sha256:c2fad19143a9132f67605c3ba10775dc1e4e0e9fa1a06f335f7ce4891a02aba5 +# output-digest: sha256:b9bf3d0c64c0fb371596e7d090e82e62aebbfde91929115fc15fb28644e4fd38 # edit-source: # - .gds/repository.yaml # - policies/base/repository-default.yaml @@ -33,7 +33,7 @@ jobs: name: GDS fast permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 with: fetch_depth: 0 # Public hosted CI uses GitHub's service cache; the pinned reusable @@ -53,7 +53,7 @@ jobs: needs: fast permissions: contents: read - uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@a624689c897c5f4733cf475159e77bba3a2b98c7 + uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 with: fetch_depth: 0 cache: true diff --git a/tests/golden/projections/control-plane/AGENTS.md b/tests/golden/projections/control-plane/AGENTS.md index bd6e0ea..1cc1b5f 100644 --- a/tests/golden/projections/control-plane/AGENTS.md +++ b/tests/golden/projections/control-plane/AGENTS.md @@ -3,7 +3,7 @@ GENERATED FILE - DO NOT EDIT DIRECTLY generator: gds bundle: 0.9.4-dev source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001 -input-digest: sha256:e9687bc6603c6252585736cc1745c9096de32cf97fca37ac0f1d8b8859135ca4 +input-digest: sha256:c2fad19143a9132f67605c3ba10775dc1e4e0e9fa1a06f335f7ce4891a02aba5 output-digest: sha256:819456f92e6f6b6e6c49fdf53a1f73988508e6a9dbc705daa7329203749b63aa edit-source: - .gds/repository.yaml From a4d15470605966824c93ad2bfc5dc07e22bb38fe Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Tue, 15 Sep 2026 04:32:19 +0500 Subject: [PATCH 2/2] chore(ci): regenerate gds-ci projection after workflow_ref pin Co-authored-by: Cursor --- .gds/bundle.lock.yaml | 10 +++++----- .github/workflows/gds-ci.yml | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml index e3ab645..e1e50e7 100644 --- a/.gds/bundle.lock.yaml +++ b/.gds/bundle.lock.yaml @@ -5,14 +5,14 @@ bundle: version: "0.9.4-dev" release_sequence: 0 channel: "development" - source_tree_digest: "sha256:2b1a4353cef1f4e5ca83504a7f9cffb21ac04fcaf3e31d32068b108cba735d84" - digest: "sha256:4fced9b3b3ba51cbf1390489310ce01ce21d180a95d601771db066bfb9b0a8f5" + source_tree_digest: "sha256:90b0640fff2f50074048eac7f73a79f385546758cc7d1d7c23424dc218eadcd6" + digest: "sha256:6c7e560ee6299259acd2fd2e1edd6eb083f9cbc8d707a36913fb69d39ffd59f8" projection: - input_digest: "sha256:e0ebdc1dfa4345e685358212879ba7e2e39d8c666d60e2f1dba468c415626393" - output_digest: "sha256:e33b2ddf57c2990f9f9521eb011edcac98073683e5b476fdcc59e6e34329cabe" + input_digest: "sha256:09499feb56c896a377b4e041584d4db2a32537f744a91f323a0ed3efd20d73ed" + output_digest: "sha256:1412c2e0568bf067755755577cd1bf1c735b8760486e831b151b54009de75b15" files: - path: ".gds/compiled-policy.json" digest: "sha256:37ece9020fd9eeed4ee90582600c5e50cb3a7e32ee773719d1ccfad2d9cd1b6d" - path: ".github/workflows/gds-ci.yml" - digest: "sha256:d77abe7402b55f8e8315b0f2077126713836dd179b8cdb108c024bd39d5f3b16" + digest: "sha256:0ab163157aef7e1ff5e76dfe240fda39f293596e252d4307c6e1700745af168f" diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml index 49361d4..80b48da 100644 --- a/.github/workflows/gds-ci.yml +++ b/.github/workflows/gds-ci.yml @@ -1,9 +1,9 @@ # GENERATED FILE - DO NOT EDIT DIRECTLY # generator: gds # bundle: 0.9.4-dev -# source-tree-digest: sha256:2b1a4353cef1f4e5ca83504a7f9cffb21ac04fcaf3e31d32068b108cba735d84 -# input-digest: sha256:e0ebdc1dfa4345e685358212879ba7e2e39d8c666d60e2f1dba468c415626393 -# output-digest: sha256:15b87303cd0692fd8e5d88281771dded9fdc2fc027d600681155cb4e71f42386 +# source-tree-digest: sha256:90b0640fff2f50074048eac7f73a79f385546758cc7d1d7c23424dc218eadcd6 +# input-digest: sha256:09499feb56c896a377b4e041584d4db2a32537f744a91f323a0ed3efd20d73ed +# output-digest: sha256:b9bf3d0c64c0fb371596e7d090e82e62aebbfde91929115fc15fb28644e4fd38 # edit-source: # - .gds/repository.yaml # - policies/base/repository-default.yaml