feat(pin-bump-alone): a dependency pin bump lands in its own PR

[mark-brannan]

A reusable workflow, called per repo like adr-elsewhere.yml: it fails a PR that moves a package's lockfile resolved and touches a path outside package.json, package-lock.json and the caller's allow globs.

What a failing run prints:

the colregs pin moves: git+ssh://…/colregs.git#28e28da… -> git+ssh://…/colregs.git#46d5c3f…
paths outside a pin bump's reach:
  src/evaluate.ts
::error::a colregs pin bump mixed with other work
Split it: the pin bump and what its data forces land alone; the rest follows.
Bypass is the pin-bump-mixed-ok label, a human's to apply.

Why: colregs-engine#166 moved the colregs pin 0.3.4 → 0.3.5 inside a refactor, and the shard piece-merge test timed out; a red test could not be traced to the pin or to the code.

• Bypass: the pin-bump-mixed-ok label. It is read from the API at run time, not the event payload, so re-running the failed job after labelling sees it; the caller's CI need not trigger on labeled.
• Cost per push: one job, a checkout with full history and a git diff; seconds.
• Verified by running the step's script against colregs-engine history: #163 and #139 (pin bumps with source edits) fail, #163 with the label passes, #160 and #162 (no pin move) pass. The live red is a scratch PR in colregs-engine once the caller PR exists.

The caller PR in colregs-engine follows, pinned to @main, so this merges first.

🤖 Generated with Claude Code

[github-actions]

Complexity: no change

Measured 0 changed files, df8b4de against eb7307e. No function's complexity moved.
Every metric is in the run's complexity artifact: complexity run

[github-actions]

Duplication: 0 new clones, 1 new repeated literal

Whole tree	Base	Head
Clones (jscpd, 5+ lines, 50+ tokens)	10	10
Duplicated lines	87 (1.66%)	87 (1.62%)
Repeated literals (20+ characters, 2+ files)	20	21

New repeated literals

Literal	Files	Newly in
not a pull request: nothing to compare	2	.github/workflows/pin-bump-alone.yml

Scanned the whole tree, df8b4de against eb7307e. A measurement, not a gate.
Every clone and literal is in the run's duplication artifact: duplication run

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: mark-brannan/coderabbit/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c3aee052-dc1b-498c-810c-36891a5aded9

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Claude finished @mark-brannan's task in 1m 19s —— View job

---

Review: pin-bump-alone

I left two inline comments. Neither is a security problem.

Where	What	Fix
pin-bump-alone.yml:72	The git fetch of the base is redundant: fetch-depth: 0 already fetches origin/$BASE. With persist-credentials: false the fetch runs without credentials, so in a private caller repo it fails under set -e before any check runs.	Delete the line.
README.md:13	The table cell is about 250 characters; the writing rubric caps a cell at 110 and says to match the shortest neighbouring row.	Use the one-line suggestion in the inline comment.

What I checked and found sound:

• Permissions: the job only has contents: read and pull-requests: read. The token gets no write access.
• Secrets and untrusted input: the only secret is github.token, used for one label read. The base ref, the package name and the allow globs reach the shell through env:, never written into the script.
• Which diff it checks: it compares the merge base with the PR's merge commit. That still holds on the label-then-re-run path, even if the base branch has moved since the event.
• No lockfile or no such package: a missing package-lock.json, or a package not in it, reads as "pin unchanged", so the PR passes.
• Label check: if the label API call fails, the job fails. It does not pass by default.
• Action pinning: actions/checkout@v7 is a tag, not a commit SHA. Every workflow in this repo pins it the same way, so I haven't flagged it as a problem specific to this PR.

[claude]

Claude finished @mark-brannan's task in 25s —— View job

---

Review: pin-bump-alone (e5a2f88)

Both earlier threads are addressed: the credential-less git fetch is gone, and the README row is now short. I left one new inline comment.

Where	What	Fix
README.md:13	The row writes uses: …/pin-bump-alone.yml@main, so a caller can't copy it. Every other row gives the full path.	Spell out the path (suggestion in the inline comment).

Checked and sound:

• Permissions and secrets: still contents: read and pull-requests: read. The only secret is github.token, used for one label read.
• Untrusted input: packages, allow, the base ref and the PR number reach the shell through env:. The package name goes to jq via --arg, and allow entries become pathspecs in an array, so none of it is interpolated into the script.
• Multiple packages: the loop reads the list line by line, skips blank lines, and collects every package that moved. A missing lockfile or package reads as "unchanged", so it passes.
• Label bypass: it is read from the API at run time, and a failed API call fails the job rather than passing it.

I did not re-raise the actions/checkout@v7 tag pin. It is a third-party action, and the repo pins it that way everywhere.

[claude]

Claude finished @mark-brannan's task in 18s —— View job

---

Review: pin-bump-alone (f11d6a5)

Nothing new to raise. The README row now matches the earlier suggestion exactly, and the three earlier threads are addressed.

Checked and sound:

• Permissions and secrets: still contents: read and pull-requests: read. The only secret is github.token, used for one label read.
• Untrusted input: packages, allow, the base ref and the PR number reach the shell through env:. allow entries become pathspecs in an array. The package name goes to jq via --arg.
• Pin detection: a missing lockfile or package reads as "unchanged", so the PR passes. Several packages are collected into one message.
• Label bypass: it is read from the API at run time, and a failed API call fails the job rather than passing it.
• README row: about 109 characters with markup stripped, under the 110 cap, and the uses: path is spelled out.

I did not re-raise the actions/checkout@v7 tag pin. The repo pins it that way everywhere.