allowlist: add carabiner-dev install/{download-and-verify,ampel-bootstrap} (levels 2-3)#853
Open
potiuk wants to merge 3 commits into
Open
allowlist: add carabiner-dev install/{download-and-verify,ampel-bootstrap} (levels 2-3)#853potiuk wants to merge 3 commits into
potiuk wants to merge 3 commits into
Conversation
…trap} (levels 2-3) Follow-up to #831 — that PR added the level-1 transitive siblings install/{ampel,bnd} @ v1.1.7 (SHA 2a11d59a135c5e291f305f249a92ad7903e3ee0f), but the sibling-call chain rooted at carabiner-dev/actions/ampel/verify@v1.2.0 is actually four levels deep: ampel/verify @ v1.2.0 (e0e3b81…) └── install/{ampel,bnd} @ v1.1.7 (2a11d59…) [added by #831] └── install/download-and-verify (6022a06…) [this PR] └── install/ampel-bootstrap (0a075bb…) [this PR] ampel-bootstrap is a leaf — no further sibling refs. After this PR the check-for-transitive-failures workflow should go green; the immediately preceding failure log was on the missing download-and-verify SHA. Underlying scaling issue (sibling-chain pattern explosion) tracked at #852 and upstream at carabiner-dev/actions#57. Generated-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ppkarwasz
requested changes
May 18, 2026
Member
ppkarwasz
left a comment
ppkarwasz
left a comment
There was a problem hiding this comment.
I had a feeling, there were more than one level of indirection…
The sort-actions-yml hook re-orders alphabetically by key, which places install/ampel-bootstrap between install/ampel and install/bnd rather than after install/download-and-verify (the depth-ordered position I originally used). Generated-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Per ppkarwasz's review, the level-2 and level-3 SHAs aren't tagged upstream — they're intermediate commits between v1.1.6 and v1.1.7. Remove the misleading `tag: v1.1.7` and move the call-chain comment up to the action-key level so it survives the sort-actions-yml hook (standalone comments under an empty SHA sub-map get dropped on sort, inline-or-key-level comments survive). Generated-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ppkarwasz
approved these changes
May 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #831 — that PR added the level-1 transitive siblings
install/{ampel,bnd}@v1.1.7, but the sibling-call chain rooted atcarabiner-dev/actions/ampel/verify@v1.2.0is actually four levels deep:ampel-bootstrapis a leaf — no further sibling refs.The hourly
check-for-transitive-failuresworkflow has continued to fail post-#831 withcarabiner-dev/actions/install/download-and-verify@6022a065d6420de5d86333ecfb2b25c57f84b699 is not allowed(e.g. run 26062684716). After this PR the next failure (if any) would be onampel-bootstrap, which is also pre-emptively added here.Test plan
update_composite_action.ymlregeneratesapproved_patterns.yml+ the dependabot composite fromactions.yml.check-for-transitive-failuresrun is green.Related