Update conforma/github-workflows digest to ff1126b (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
conforma/github-workflows	workflow	digest	51213ed → ff1126b

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 202c2424-7a6d-43cf-aa1d-0cfb6e6b10e7

📥 Commits

Reviewing files that changed from the base of the PR and between cecfaed and f0424f7.

📒 Files selected for processing: 1

• .github/workflows/auto-merge.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Walkthrough

The auto-merge job now uses a reusable workflow at a different commit. Its trigger and permissions are unchanged.

Changes: Auto-merge workflow

Layer / File(s)	Summary
Update reusable workflow reference .github/workflows/auto-merge.yaml	The job now references commit ff1126bc5d04b54ea020efef3c699e53872f2de8 instead of 51213ed2e43b070e03cb7f49f20d9d60e7575b01.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: robnester-rh, dheerajodha

Merge Risk: ⚪ Minimal · up to f0424

The inspected workflow update introduces no concrete change to auto-merge behavior, so no actionable merge risk remains.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the workflow digest update to commit ff1126b.
Description check		The description clearly documents the digest change, source package, update direction, and Renovate configuration. It does not use the template headings or provide a separate ticket link, but it conta…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches: 💡 1

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Signals are unchanged from the prior assessment — a bot-authored single-line digest bump to a CI workflow with one protected path and active recent churn — so the prior score of 2 is preserved under re-review anchoring.

Previous run

Risk Assessment: moderate (2/5)

Details

A bot-authored single-line digest bump to a CI workflow with a protected path and very recent prior activity pushes this just above low, despite minimal size and no security or test concerns.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/workflows/auto-merge.yaml:25 — This PR modifies a file under the .github/ protected path (reusable-workflow digest bump). The PR body explains the change (automated Renovate update of conforma/github-workflows digest from 51213ed to ff1126b), and the repository's renovate.json authorizes the Renovate bot to make these updates. Even with sufficient context, human approval is always required for protected-path changes.
  Remediation: Human reviewer with repository write access must confirm the digest bump is intended and that the upstream commit range is acceptable before merge.

Previous run

Review

Findings

High

• [protected-path] .github/workflows/auto-merge.yaml:25 — This PR modifies a file under the protected path .github/, which contains governance and CI infrastructure. The PR is not linked to any issue justifying the change to a governance file. Although the PR body documents the mechanical nature of the update (an automated Renovate digest bump) and the repository's renovate.json configures Renovate to manage dependency updates, protected-path changes require explicit human approval regardless of context. See also: [scope-authorization-implicit] finding at this location.
  Remediation: A human maintainer must review and approve this change before merge. Approval is required for any .github/ modification even when the change is a routine automated digest bump.

Info

• [scope-authorization-implicit] N/A — Authorization inferred from mechanical nature of change (value-only / digest bump of a reusable workflow SHA pin by renovate[bot]). No architectural review required. The pin remains a 40-character full-SHA (not a mutable tag), and the surrounding permissions: block is unchanged.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Superseded by updated review

[fullsend-ai-retro]

Retro for #1908 — Renovate digest bump of .github/workflows/auto-merge.yaml

Outcome: PR merged ~9h after open. One mechanical 1-line change (conforma/github-workflows SHA pin bump). CodeRabbit returned no actionable comments; the fullsend review emitted a single [protected-path] finding (High on open, Medium after Renovate's force-push), which is the mandatory human-approval gate. A human merged it. Workflow quality was fine; what this run surfaces is operational toil already captured by many open upstream issues.

New evidence this run contributes (all tied to existing issues):

1. Wasted runner cycles on non-routable labeled events. PR open fired 4 parallel fullsend workflow runs — one for event_action=opened (ran the review) and three for event_action=labeled that each spent 67–90s in dispatch / Harness dispatch (checkout + install fullsend CLI) before dispatch / Route logged No stage matched — skipping dispatch. Confirmed in the dispatch workflow: harness-dispatch (reusable-dispatch.yml L1512) has if: ${{ inputs.matrix == '' }} but no needs: route, so it runs in parallel and always pays the CLI-install cost. A fifth no-op labeled run fired at 01:22:15 when the review agent itself added risk/moderate/requires-manual-review labels. Evidence for existing issues fullsend-ai/fullsend#7359, #7281, #6244. Related duplicate-review conditions tracked in #7384 and #7135.

2. Fix dispatch surfaces as a red-X failure when correctly skipping a bot PR. Run 38834752150 fired on pull_request_review submitted (the review bot's own CHANGES_REQUESTED), routed to Fix, correctly logged ##[warning]PR #1908 (author: app/renovate, is_bot: true) is not the coder bot and lacks 'fullsend-fix' label — skipping bot-triggered fix, then exited 1 via check-fix-eligibility.sh (two intentional exit 1 sites at L27–28 and L71–73; header comment states the exit-1 contract is deliberate). This is a textbook false-positive failure signal on every bot-authored PR touching a protected path. Evidence for existing issues fullsend-ai/fullsend#8382, #8130, #7897, #7739, #7701, #7365, #7288, #7092, #6791. The 9-way duplication across the upstream issue tracker is itself notable but is a meta-concern about retro-agent duplicate detection, not actionable here.

3. Review re-ran end-to-end on Renovate's force-push with a byte-identical workflow diff. On the second review (comment) the agent itself acknowledged "signals unchanged ... prior score of 2 is preserved under re-review anchoring" and produced the same protected-path finding. Confirmed in the review skill: there is no diff-hash short-circuit — PRIOR_REVIEW_SHA only enables severity anchoring and narrowed sub-agent dispatch, not a skip. Evidence for existing issues fullsend-ai/agents#1091, #1353, #257, #150.

4. Autonomy gap for Renovate digest bumps of .github/workflows/*.yaml. The review correctly identified the diff as mechanical ([scope-authorization-implicit] on the first pass) and cited renovate.json as authorizing config, yet the protected-path rule still blocks approval unconditionally. A human merged a 1-line SHA pin bump 9 hours later with no change-of-mind. Evidence for existing issue fullsend-ai/agents#1616 (change-type-aware protected-path exemptions for bot digest updates); related: #257, conforma/policy#1850.

Judge scores

#	Candidate	Score	Disposition
1	Non-routable labeled events provision runners (dispatch/Harness has no needs: route)	3/5	summary-only (dup: fullsend#7359, #7281, #6244)
2	Fix eligibility script exits 1 on legitimate bot-PR skip, surfaces as failed workflow	4/5	summary-only (dup: fullsend#8382, #8130, #7897, #7739, #7701, #7365, #7288, #7092, #6791)
3	Review re-runs on force-push with identical diff; no diff-hash short-circuit	3/5	summary-only (dup: agents#1091, #1353, #257)
4	Protected-path mandatory on Renovate .github/workflows/*.yaml digest bumps blocks autonomy with no value add	3/5	summary-only (dup: agents#1616, #257)

Filing: zero new issues. Every candidate has an open upstream duplicate; per the Conforma retro-filing-policy a duplicate is summary-only regardless of score. Also noted: fullsend-ai/agents is not in this repo's .fullsend/config.yaml create_issues.allow_targets, so agent-layer proposals could not be filed from here even if non-duplicate.

Workflow-reconstruction note: the originating workflow run (fullsend on pull_request_target at 10:50:12, run 38889832996) was triggered by the merge closed event — this retro itself is the fifth+ fullsend dispatch for this PR.