Pin pm-github 2026.11.04 and let Dependabot workflow bumps pass without a hand-edited version input (pm-web-qg8v)

Merged
UN
10d ago
+53-9

Summary

Every Dependabot pm-github workflow bump in this repo has been failing (#286, #287, open since 2026-11-01). The workflow-security policy required the deprecated pm-github-version input to equal the release comment on the pinned commit. Dependabot rewrites only the commit and the comment, so the stale input broke the policy every time. As a result the scheduled sync still runs pm-github 2026.10.19. Tonight that release's privacy gate refused a JavaScript regex literal in #218, which current pm-github accepts.

The reusable workflows document the input as a fallback for non-release commits only. This PR makes the pinned release commit the only version source:

  • Both callers now pin pm-github 2026.11.04 (eb89c6a, tag v2026.11.04) without the input. This brings in:
    • the repeat-import no-op and closeout fixes from 2026.10.30 and 2026.10.31;
    • pm-github#213, the import privacy gate fix for public technical forms such as #218's regex literal;
    • pm-github#214, which strips the zero padding from release tags (v2026.11.04 → npm 2026.11.4) before the reusable workflows verify and install the version.
  • test/workflow-security.test.ts refuses the deprecated input instead of requiring it to match. Re-adding the input, with a matching or a mismatched value, fails the policy.
  • test/workflow-update-automation.test.ts adds a Dependabot-style scenario for both callers. Changing only the commit and the release comment passes the real policy.

Evidence

  • node --test test/workflow-security.test.ts test/workflow-update-automation.test.ts: 8/8. Typecheck passes.
  • Revert proof: with the old equality rule restored, a sync caller bumped only in commit and comment (input left at 2026.10.19) fails the update-automation test 1/1.
  • Permissions match the callers already on pm-github 2026.10.28 (pm-csv) and 2026.10.23 (pm-review). Between 2026.11.02 and 2026.11.04 the reusable workflows changed only the tag normalization: no new inputs, secrets or permissions.
  • 2026-11-04: re-pinned from 2026.11.02 to 2026.11.04 and merged main (bc3c5d0, Release pm-web v2026.11.04). The two policy suites pass 8/8 again, and typecheck and changelog:check pass.

pm-web-71et fixed the same deadlock once by hand-editing the input. This change removes the coupling instead.

pm items

Supersedes #286 and #287.

Summary by Sourcery

Pin the pm-github workflows to 2026.11.04 and remove the deprecated version input so automated dependency bumps pass policy without manual edits.

Bug Fixes:

  • Update the pm-github sync and closeout callers to release 2026.11.04, including fixes for repeat imports, closeout handling, and privacy-gated imports.

Enhancements:

  • Make the pinned reusable-workflow commit the sole pm-github version source by removing the deprecated version input.
  • Update workflow policy checks to reject the deprecated version input and verify that Dependabot-style pin and release-comment updates pass automatically.

Tests:

  • Add coverage for Dependabot-style updates to both pm-github workflow callers and for rejecting stale or reintroduced version inputs.

Chores:

  • Record the associated pm work item and history.

Summary by CodeRabbit

  • Chores
    • Updated the closeout and sync workflows to use the current pm-github release and removed the deprecated version setting.
    • Updated workflow validation to reject callers that supply the deprecated setting while continuing to check documented releases.
    • Added automated checks for release updates to both workflow callers.