From bb107274d8841a2d9c8c0d75f8de1898192c7e31 Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Tue, 22 Sep 2026 05:24:09 -0400 Subject: [PATCH 1/3] fix(api-docs/ts): disable setup-bun's cache in the template The TypeScript api-docs job runs on release tags and opens a cross-repo PR with DOCS_REPO_PR_TOKEN, so it is a privileged context. setup-bun enables dependency caching by default, which zizmor flags at error severity: a less-trusted run can populate the shared cache and have it restored here. resq-software/npm has carried this mitigation in its copy of the workflow since 2026-05-31, and that commit said in as many words that the upstream template needed the same change or the next sync would regress it. It never got it. Because the sync is a wholesale file copy, running automation/sync-templates.sh typescript today would delete the mitigation from the consumer. The npm copy cites that repo's own code-scanning alert number; the rationale is generalised here since it holds for any TypeScript consumer. The install step is already --frozen-lockfile, so a cold install is functionally identical. no-cache exists in setup-bun v2.0.2 (the pin in this file) as well as in the newer v2.2.0, so this change stands on its own. --- automation/source-repo-templates/api-docs.typescript.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/automation/source-repo-templates/api-docs.typescript.yml b/automation/source-repo-templates/api-docs.typescript.yml index b1d27325..cd011b45 100644 --- a/automation/source-repo-templates/api-docs.typescript.yml +++ b/automation/source-repo-templates/api-docs.typescript.yml @@ -107,6 +107,13 @@ jobs: uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2 with: bun-version: latest + # This job runs on release tags and opens a cross-repo PR using + # DOCS_REPO_PR_TOKEN, so it is a privileged context. Disable + # setup-bun's default dependency cache: a cache populated by a + # less-trusted run must not be restorable here (zizmor + # cache-poisoning, error severity). The install step below is + # --frozen-lockfile, so a cold install is functionally identical. + no-cache: true - name: Install workspace deps run: bun install --frozen-lockfile From 0bdd540a24ea7fceb34656dd0132b8f1c3bdb669 Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Tue, 22 Sep 2026 05:24:22 -0400 Subject: [PATCH 2/3] docs(api-docs/ts): show the live scope in the DOCS_REF_SLUG example Last surviving @resq-sw literal in this template that refers to the npm scope rather than to the machine account. The packages moved to @resq-systems in July 2026; npm corrected this comment in its own copy at the time and the correction was never brought back. Comment only, no behaviour change. The tags: list keeps matching both scopes, which is deliberate (#101) and is left alone; this only stops the worked example from demonstrating a scope nothing publishes under any more. --- automation/source-repo-templates/api-docs.typescript.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automation/source-repo-templates/api-docs.typescript.yml b/automation/source-repo-templates/api-docs.typescript.yml index cd011b45..ca46313a 100644 --- a/automation/source-repo-templates/api-docs.typescript.yml +++ b/automation/source-repo-templates/api-docs.typescript.yml @@ -76,7 +76,7 @@ jobs: # workflow_dispatch can pass an alternate ref via inputs.ref; # fall back to github.ref_name (already stripped of refs/...). # DOCS_REF_SLUG is branch-safe for use in PR/branch names - # (`@resq-sw/ui@v0.35.6` → `resq-sw-ui-v0.35.6`). + # (`@resq-systems/ui@v0.35.6` → `resq-systems-ui-v0.35.6`). # # The ref is routed through env: instead of being inlined via # ${{ }}. Inlining at template-expansion time would interpolate From df63a1729f825014ae86db9e2b7734cd1e50e7ec Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Tue, 22 Sep 2026 05:25:17 -0400 Subject: [PATCH 3/3] chore(api-docs/ts): pin the actions every consumer already runs Dependabot's github-actions ecosystem only scans .github/workflows/, so automation/source-repo-templates/ is invisible to it. This repo's own dependabot.yml covers the workflows and nothing else, and the result shows: changelog-sync.yml here runs checkout v7.0.0 and create-pull-request v8.1.1 while every template still names v6.0.2 and v7.0.8. The consumers diverged the other way, because they do get Dependabot: repo checkout create-pull-request crates v7.0.1 v8.1.1 npm v7.0.1 v8.1.1 pypi v7.0.1 v8.1.1 vcpkg v7.0.1 v8.1.1 dotnet-sdk v6.0.2 v7.0.8 Four consumers converged on the same SHAs independently, so these are the org's versions and the templates are the outlier. Since sync-templates.sh overwrites the consumer file wholesale, syncing this template today would walk npm back a major on both, plus setup-bun v2.2.0 -> v2.0.2. Every SHA below was resolved against the upstream tag before use: actions/checkout v7.0.1 3d3c42e5aac5ba805825da76410c181273ba90b1 oven-sh/setup-bun v2.2.0 0c5077e51419868618aeaa5fe8019c62421857d6 peter-evans/create-pull-request v8.1.1 5f6978faf089d4d20b00c7766989d076bb2fc7f1 create-pull-request v8 is a major bump, so its input surface was diffed against this step: all 12 inputs used here (add-paths, author, base, body, branch, commit-message, committer, delete-branch, labels, path, title, token) are still accepted by v8.1.1. npm's copy has run this workflow green on setup-bun v2.2.0 and create-pull-request v8.1.1, three times on 2026-07-27, at checkout v7.0.0. The v7.0.1 patch bump landed the day after and has not had a release-tag run yet; it is the SHA the other consumers carry and the one lychee.yml in this repo already runs. Hand-bumping is a stopgap. The durable fix is to get the template directory under automated updates, or to stop carrying literal pins in the templates at all; that is bigger than this PR and the other four templates have the same rot (the python template pins setup-uv v6.0.0 while pypi runs v10.1.0). This commit is separable if you would rather fix it centrally. --- automation/source-repo-templates/api-docs.typescript.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/automation/source-repo-templates/api-docs.typescript.yml b/automation/source-repo-templates/api-docs.typescript.yml index ca46313a..d30f9c7f 100644 --- a/automation/source-repo-templates/api-docs.typescript.yml +++ b/automation/source-repo-templates/api-docs.typescript.yml @@ -98,13 +98,13 @@ jobs: } >> "$GITHUB_ENV" - name: Checkout source repo - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ inputs.ref || github.ref }} persist-credentials: false - name: Setup Bun - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: bun-version: latest # This job runs on release tags and opens a cross-repo PR using @@ -510,7 +510,7 @@ jobs: rm _pages.txt - name: Checkout docs repo - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: resq-software/docs path: docs-checkout @@ -624,7 +624,7 @@ jobs: PYINNER - name: Open PR in docs repo - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: path: docs-checkout token: ${{ secrets.DOCS_REPO_PR_TOKEN }}