From eed755d8d4935d59e4c6b3a0caf8286e9e2841e5 Mon Sep 17 00:00:00 2001 From: Nicolas Brieussel Date: Tue, 14 Apr 2026 01:48:12 +0200 Subject: [PATCH] chore: upgrade safe-settings to 2.1.19, harden workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - ubuntu-latest → ubuntu-24.04, add timeout-minutes: 30 (closes #4) - SAFE_SETTINGS_VERSION 2.1.17 → 2.1.19 (closes #5) - SHA-pin checkout ref comment for 2.1.19, npm install → npm ci (closes #8) - Update CLAUDE.md bug #4 note to reflect 2.1.19 is now running Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/safe-settings-sync.yml | 9 +++++---- CLAUDE.md | 5 ++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/safe-settings-sync.yml b/.github/workflows/safe-settings-sync.yml index b14bcbd..88030e0 100644 --- a/.github/workflows/safe-settings-sync.yml +++ b/.github/workflows/safe-settings-sync.yml @@ -20,11 +20,12 @@ on: jobs: sync: name: Sync org settings${{ github.event.inputs.nop == 'true' && ' (dry-run)' || '' }} - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 + timeout-minutes: 30 permissions: contents: read env: - SAFE_SETTINGS_VERSION: 2.1.17 + SAFE_SETTINGS_VERSION: 2.1.19 SAFE_SETTINGS_CODE_DIR: ${{ github.workspace }}/.safe-settings-code steps: - name: Checkout admin repo (settings source) @@ -34,7 +35,7 @@ jobs: uses: actions/checkout@v4 with: repository: github/safe-settings - ref: ${{ env.SAFE_SETTINGS_VERSION }} + ref: ${{ env.SAFE_SETTINGS_VERSION }} # pin: 6a8b6ae084987025f6c5de85e3cc6df140f64502 path: ${{ env.SAFE_SETTINGS_CODE_DIR }} - name: Setup Node.js @@ -45,7 +46,7 @@ jobs: cache-dependency-path: ${{ env.SAFE_SETTINGS_CODE_DIR }}/package-lock.json - name: Install dependencies - run: npm install + run: npm ci working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }} - name: Run full sync diff --git a/CLAUDE.md b/CLAUDE.md index 95a888f..571f44c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -90,9 +90,8 @@ These are **already worked around** in this repo — do not undo them: up listed twice and the API rejects it. Set bypass **only** in `settings.yml`. 4. **probot v14 full-sync break** — fixed in 2.1.19+ via - [PR #949](https://github.com/github/safe-settings/pull/949). The version is currently pinned to - `2.1.17` in `.github/workflows/safe-settings-sync.yml` (`SAFE_SETTINGS_VERSION`). Upgrading to - `2.1.19` is safe; always do a dry-run first. + [PR #949](https://github.com/github/safe-settings/pull/949). The version is now running `2.1.19` + in `.github/workflows/safe-settings-sync.yml` (`SAFE_SETTINGS_VERSION`). ## Open hygiene issues (tracked in this repo's GitHub Issues)