Refresh the Nix vendorHash on Dependabot Go bumps - #702
Conversation
#697 changed go.sum, nix/package.nix's vendorHash stayed put, and because "Nix flake builds" is not a required check here the PR auto-merged red and main's flake was broken until #701 refreshed the hash by hand. This thin caller runs basecamp/.github's reusable workflow on Dependabot PRs that touch go.mod or go.sum: it builds the flake at the PR's merge commit, takes the corrected hash from Nix's go-modules fixed-output mismatch, and commits exactly that one line back to the PR with a one-hour App token, so the PR's own Nix check verifies it before auto-merge lands it. Pinned to the reusable workflow's branch SHA; re-pin once it merges.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
🟡 Changes recommended
Merge-order, changed-file validation, and merge-base races undermine the workflow’s reliability and security guarantees.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds automation to refresh stale Nix vendorHash values on Dependabot Go updates.
Changes:
- Triggers on Go dependency changes or manual dispatch.
- Calls a SHA-pinned reusable workflow with scoped permissions and App credentials.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
.github/workflows/dependabot-sync-nix-vendor-hash.yml |
Adds the thin caller for automated Nix hash refreshes. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 3
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d990965b2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…endor-hash * origin/main: ci: bump zizmorcore/zizmor-action in the github-actions group (#698) Reference in-repo workflows with GitHub's self-repository syntax (#700) Kill the Codex probe's process group when its deadline expires (#694) Refresh the Nix vendorHash for the go-dependencies bump (#701)
Auto-merge waits for required checks only, and "Nix flake builds" is not one here, so a stand-alone refresh workflow raced the merge: the required checks could finish and land the stale head minutes before the push, which would then reach a closed PR. The refresh now lives in the auto-merge workflow and the auto-merge job `needs:` it, so `gh pr merge --auto` runs only once the hash is current or the push has landed, and not at all when the refresh failed. The reusable workflow decides "Go bump" from the PR's changed files and is a no-op otherwise, so the path filter goes away and an actions bump can never receive the push; re-pinned to the basecamp/.github head that enforces that.
There was a problem hiding this comment.
🟡 Changes recommended
The refresh dependency unintentionally prevents eligible Docker Dependabot updates from auto-merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Balanced
|
Fixed — the Docker regression Copilot's 21:45 review found (the changed-files allowlist ran before the Go-bump decision, so docker and actions bumps would have lost auto-merge) was closed in d968679, which pins the reusable workflow at the revision where non-Go bumps are a successful no-op ahead of the allowlist; that is the head the 21:54 review looked at. On "credentialed automation and merge gating require final human review": the PR body carries the merge order (basecamp/.github#19 first, then re-pin and merge this), the App and Dependabot-secret provisioning, and the actor analysis; those are for Jeremy, and nothing here merges itself. |
Stacked on basecamp/.github#19 and pinned to its branch SHA; re-pin to the merged SHA once that lands.
#697 changed
go.sumthis morning, thevendorHashinnix/package.nixstayed put, and because "Nix flake builds" is not a required check here the PR auto-merged red; main's own Nix job then reported success with the build skipped (the merge commit matched none of its filter paths), and every branch that did build — #698, #700 — failed until #701 refreshed the hash by hand.The refresh now lives in
dependabot-auto-merge.yml, ahead of the auto-merge job. On every Dependabot PR therefresh-nix-vendor-hashjob calls the reusable workflow, which decides "Go bump" from the PR's changed files —go.mod,go.sumandnix/package.nix, nothing else, or it refuses; neithergo.modnorgo.sum, and it is a no-op — then builds the flake at the PR's merge commit, takes the corrected hash from Nix's go-modules fixed-output mismatch, and commits exactly that one line ofnix/package.nixback to the PR with a one-hourcli-release-bottoken scoped to this repository. Theauto-mergejobneeds:it, sogh pr review --approveandgh pr merge --autorun only once the hash is current or the push has landed, and not at all when the refresh failed — that PR waits for a human. The ordering is structural, not a race against the required checks, which is what a stand-alone refresh workflow would have been: the required checks can finish minutes before a Nix build does, and #697 merged within minutes. The App push re-triggers the PR's own CI, whose Nix check verifies the new hash on the pushed head; the re-triggered run is actored by the App bot, so the Dependabot actor guard skips both jobs, and auto-merge stays enabled because the App is a write-access actor.Why pushing into a Dependabot PR is sound here when it was abandoned for actions bumps (basecamp/.github#11): the workflow code that re-runs after the push is main's, the reusable workflow refuses any PR whose diff reaches outside the three Go-bump files, and I audited every
pull_requestjob in this repo. The only secret referenced isANTHROPIC_API_KEYinskill-eval, which is path-gated toskills/basecamp/SKILL.mdandskill-evals/**— paths a Go bump never touches — so the actor flip exposes nothing to the bumped dependency code thatgo testdoes not already run under Dependabot's sandbox. The reusable workflow's header carries the full reasoning; this file's header states the invariant to keep.workflow_dispatchwith a PR number re-runs the refresh by hand.This repo already holds
RELEASE_APP_PRIVATE_KEYas a repository Dependabot secret (set 2026-02-05), which is what the Dependabot-triggered path reads. The client id is passed as a literal becausevars.RELEASE_CLIENT_ID, like the private keyrelease.ymluses, is scoped to thereleaseenvironment and unreadable here (confirmed by a probe on the hey-cli branch); a client id is a public identifier. Still needed: thecli-release-botApp installed on this repository withcontents: write(I cannot see its installation list), and, only if the manualworkflow_dispatchpath is wanted, the key as a repository Actions secret of the same name. Separately worth doing once this lands: add "Nix flake builds" tomain-gate's required checks. The sequencing above keeps a stale head from merging ahead of the refresh; the required check is what also holds the hash against a base branch whosego.summoves after the push, which no workflow can. That is a ruleset change, not a workflow one, and it is not part of this PR.actionlint 1.7.12 and zizmor 1.30.0 are clean (
make lint-actions); thebot-conditionsignores carry the same dual-check reasoning as before. No required check changes. Localbin/cinote:make testfails on this Mac in the TTY-dependentTestIsInteractive*tests identically onmain, which a workflow-only change cannot touch; CI runs the real gate.Summary by cubic
Extends the Dependabot auto-merge workflow to refresh the Nix
vendorHashinnix/package.nixon Go bumps, so the flake build passes before auto-merge. Previously, Go bumps auto-merged with a stale hash and broke main's flake because "Nix flake builds" isn't a required check.refresh-nix-vendor-hashjob builds the flake at the PR's merge commit, commits the corrected hash back to the PR, and theauto-mergejobneeds:it.dependabot[bot], plus a manualworkflow_dispatchpath; the pinned reusable workflow makes non-Go bumps a no-op.pull_requestjobs free of secrets a Go bump can reach.Setup
cli-release-boton this repo withcontents: write.RELEASE_APP_PRIVATE_KEY(and as an Actions secret for the manual path).main-gate's required checks.Written for commit d968679. Summary will update on new commits.