deps: bump the minor-and-patch group across 1 directory with 4 updates #327
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| # `pricing-review` is here because the pull_request event never fires for | |
| # that branch, and the reason is not obvious. | |
| # | |
| # GitHub deliberately does not trigger workflows for events created with | |
| # `GITHUB_TOKEN`, to stop a workflow triggering itself forever. The daily | |
| # sync opens its review pull requests with that token, so those PRs arrive | |
| # carrying only the checks that run on their own schedule — CodeQL — and | |
| # none of `verify`. The one class of change where catalog validation matters | |
| # most was the one class arriving unvalidated. | |
| # | |
| # Found on 2026-08-04, on a pricing PR that had to be verified by hand | |
| # before it could be merged. Triggering on the branch push instead sidesteps | |
| # the token restriction entirely and needs no credentials, where the | |
| # alternative — a fine-grained PAT passed to the action — needs a secret | |
| # that can open pull requests. | |
| # | |
| # The branch name must track sync-pricing.yml's `branch:` value exactly — | |
| # `pricing-sync/**` never matched the actual `pricing-review` branch that | |
| # workflow pushes to, so this trigger silently never fired. Found on | |
| # 2026-08-19 when PR #77 merged carrying only CodeQL, no `verify`. | |
| branches: [main, pricing-review] | |
| pull_request: | |
| # A manual handle on the same gate. | |
| # | |
| # Twice now a pull request has arrived carrying only CodeQL and none of | |
| # `verify` — see the note above on GITHUB_TOKEN, and PR #77 on 2026-08-19. | |
| # Both times the fix was to make some *other* event fire. That works only once | |
| # the cause is known, and the symptom is silent: a green pull request that was | |
| # never actually verified looks exactly like one that was. | |
| # | |
| # `workflow_dispatch` removes the dependency on diagnosing the cause. Whatever | |
| # swallowed the event, the gate can still be pointed at the branch by hand from | |
| # the Actions tab, and its result read before merging. | |
| workflow_dispatch: | |
| # Least privilege for GITHUB_TOKEN. Without this block a job inherits the | |
| # repository default, which is broader than anything here needs — nothing in the | |
| # verify gate writes to the repository, opens a pull request or publishes. | |
| # | |
| # CodeQL's hint for this file is an empty block, and that is one step too far: a | |
| # reusable workflow's permissions are capped by its caller, so granting nothing | |
| # here would leave `verify.yml` unable to check out the code it exists to test. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # A single reusable gate. Both CI and the Pages deploy call this same job, so | |
| # there is exactly one definition of "verified" and no way to ship past it. | |
| verify: | |
| uses: ./.github/workflows/verify.yml |