Skip to content

ci(deps): carry licence rows forward for bumped action pins - #1116

Draft
github-actions[bot] wants to merge 1 commit into
mainfrom
sbom-actions/carry-20261005T055534Z
Draft

github-actions[bot] wants to merge 1 commit into
mainfrom
sbom-actions/carry-20261005T055534Z

Conversation

@github-actions

@github-actions github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

Opened by sbom-actions-currency.

sbom-check refuses an action pin with no row in mise-tasks/sbom-actions.tsv, and Renovate cannot write that table — so every action bump opens red and holds the prConcurrentLimit: 1 slot (CLOUD-1213).

Each row here is the same repository's existing row with only the sha changed. It was carried forward only after every candidate licence file was confirmed byte-identical between the mapped commit and the new one, so the judgement already recorded still describes those exact bytes. Nothing was re-derived.

A pin whose licence files differ, or whose repository has no row at all, is not here — it is reported as a warning in the run log for a person to read.

Refs: CLOUD-1213

DO-NOT-CLOSE CLOUD-1213

Every row here was copied verbatim from the same repository's
existing row with only the sha changed, after confirming every
candidate licence file is byte-identical between the two commits.
No licence was re-derived and no verdict inferred.

Refs: CLOUD-1213
@coderabbitai

coderabbitai Bot commented Oct 5, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: button-inc/batten/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 553e565f-db05-4086-96cc-8181d4aeebc3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@wenzowski
wenzowski marked this pull request as ready for review October 5, 2026 06:53
@wenzowski
wenzowski marked this pull request as draft October 5, 2026 07:46
@wenzowski wenzowski added the renovate-frozen Red on a check no bump can fix; Renovate is not rebasing it label Oct 5, 2026
@wenzowski

Copy link
Copy Markdown
Contributor

This head is red on: ci, final.

The lane has returned it to draft and added renovate-frozen, so
Renovate will stop rebasing it and this pull request stops spending
CI minutes it cannot convert into a landing. Nothing here retries on
its own: a dependency bump cannot fix a check that needs a change to
the repository.

To resume, land the fix on main and remove the label. The next
rebase mints a fresh head, the lane readies it once, and it lands if
it is green.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

renovate-frozen Red on a check no bump can fix; Renovate is not rebasing it

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant