Pin dependencies (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
conforma/.fullsend	workflow	pinDigest	→ 4ad3612
conforma/github-workflows	workflow	pinDigest	→ eb2bb49
conforma/pr-size-label-action	action	pinDigest	→ 9bff907
google-github-actions/run-gemini-cli	action	pinDigest	→ f77273f

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:17 AM UTC · Completed 2:23 AM UTC

Commit: 4ad3612 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.58

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unit-tests	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Tiny 8-line Renovate bot PR pinning action SHAs, but four CI workflow files (protected paths) and CI_WORKFLOW_CHANGED=true elevate the Tier 1 composite above a routine change, yielding moderate risk despite low churn and no security-sensitive edits.

[fullsend-ai-review]

Review

Mechanical Renovate PR pinning four GitHub Actions / reusable-workflow references to specific commit SHAs. The <sha> # <ref> format matches existing pins in the same workflows. All four pinned SHAs were verified against their upstream refs:

• conforma/github-workflows/.github/workflows/auto-merge.yaml@eb2bb495b1fca0a52cc1a1e2bfb1c28a6283798a — matches main tip.
• conforma/.fullsend/.github/workflows/dispatch.yml@4ad36122d5c9622554c3037c7d71768dae902997 — matches main tip.
• conforma/pr-size-label-action@9bff907ec68d5dcee52ee8b6a62cf48cf9cf3e49 — matches tag v1.2.0.
• google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489 — matches tag v0.

Findings

Medium

• [protected-path] .github/workflows/auto-merge.yaml, .github/workflows/fullsend.yaml, .github/workflows/label-pr-size.yaml, .github/workflows/release.yaml — PR modifies files under the protected .github/ path. Human approval is always required for protected-path changes, regardless of context. Authorization context: the repo's renovate.json extends github>conforma/.github//config/renovate/renovate.json, which authorizes Renovate to open dependency-pin PRs against workflow files; PR author is app/renovate; the change is a mechanical pinDigest that leaves runtime behavior unchanged (the pinned SHAs are the current tips of the previously referenced refs).

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 2:53 AM UTC · Completed 2:59 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.71

[fullsend-ai-retro]

Retrospective on conforma/policy#1836, a 4-file / 8-line Renovate pinDigest PR that pinned four GitHub Actions / reusable-workflow references to specific commit SHAs.

What happened. The review agent ran at model: opus, effort: high for ~6 minutes at a cost of $2.58 (workflow run). It verified all four SHAs against their upstream refs (genuinely useful diligence) and then produced a single Medium finding of category protected-path whose substance was: “this touches .github/, a human must approve.” The risk composite came out moderate (2/5) — driven by CI_WORKFLOW_CHANGED=4 in the Tier 1 scoring — which added the requires-manual-review and risk/moderate labels. robnester-rh approved without comments 29 minutes later and merged.

Assessment. The review agent did the right verification, but every knob was set to max for a mechanical, trusted-bot, SHA-only change. The single finding produced was a routing signal (“human must approve”), not a code-quality finding. Existing mechanisms exist but are unused or toothless: REVIEW_SKIP_AUTHORS in scripts/pre-review.sh is defined but not set for any bot; the Renovate reconciliation in skills/pr-review/SKILL.md downgrades protected-path but still posts it as Medium and still blocks approval; AUTHOR_IS_BOT contributes only 1 of 8 dimensions to the Tier 1 composite and can’t offset a single workflow-file touch.

Proposals target fullsend-ai/agents because the logic lives there and conforma/.fullsend/customized/* has no local overrides. Related upstream context: fullsend-ai/fullsend#6891 (pre-flight scope heuristic), #6791 and #6725 (routing-layer bot fast-paths), #6642 (bot-author-aware dispatch).

Proposals skipped (target repo not allowed)

File manually or update create_issues.allow_targets in config.yaml:

• Downshift review effort/model for trusted-bot mechanical PRs (Renovate pinDigest, etc.) (fullsend-ai/agents)
• Do not post protected-path as a Medium finding when Renovate/Dependabot reconciliation matches (fullsend-ai/agents)
• Dampen CI_WORKFLOW_CHANGED in Tier 1 risk composite when author is a trusted bot and diff is mechanical (fullsend-ai/agents)