From 837c8a507b93ea5288337d40d75916eaf2ecec0c Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 13 Jul 2026 09:42:18 -0400 Subject: [PATCH 1/2] ci: bump Shadow engine to v1.7 Re-pin the reusable Shadow workflow from 54ec94e (v1.6) to v1.7, following the dqdl canary (awslabs/dqdl#41, merged + soaking). v1.7 adds configurable allowed_labels and a bot_name-branded rate-limit label; no .shadow.yml change here, so those features stay dormant (behavior unchanged). OIDC unaffected: the bot role's trust is sub-scoped (repo:...:*), not pinned to the workflow ref, so the ref bump doesn't affect role assumption. --- .github/workflows/issue-bot.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/issue-bot.yml b/.github/workflows/issue-bot.yml index a91aa1f..6a821b3 100644 --- a/.github/workflows/issue-bot.yml +++ b/.github/workflows/issue-bot.yml @@ -1,5 +1,5 @@ name: Shadow # load-bearing: auto-approve.yml keys on this exact name -# To upgrade the engine, bump the SHA in BOTH `uses:` and `shadow_ref` below +# To upgrade the engine, bump the ref in BOTH `uses:` and `shadow_ref` below # (GitHub forbids expressions in `uses:`, so they can't share a variable). on: @@ -40,11 +40,11 @@ jobs: (github.event_name == 'workflow_dispatch') || (github.actor != 'github-actions[bot]' && (github.event.issue.pull_request == null || github.event_name == 'pull_request_target')) - uses: sudsali/shadow/.github/workflows/shadow-review.yml@54ec94e0ca8c90d9b58ff95a2a06b175a115784e + uses: sudsali/shadow/.github/workflows/shadow-review.yml@v1.7 with: pr_number: ${{ inputs.issue_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} - shadow_ref: 54ec94e0ca8c90d9b58ff95a2a06b175a115784e + shadow_ref: v1.7 aws_region: us-east-1 prompt_sm_prefix: pydeequ-bot secrets: From 4506fc242b7a4abf3e269103ee50df999df505b2 Mon Sep 17 00:00:00 2001 From: Sudhanshu Sali Date: Mon, 13 Jul 2026 14:28:05 -0400 Subject: [PATCH 2/2] ci: pin Shadow v1.7 by commit SHA, not the mutable tag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address review feedback: pin the reusable workflow to the full commit SHA v1.7 points to (ed31ed7) with a '# v1.7' comment, per GitHub Actions supply-chain hardening — a mutable tag could be re-pointed to run untrusted code with this workflow's OIDC/secret access. Immutable + readable. --- .github/workflows/issue-bot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/issue-bot.yml b/.github/workflows/issue-bot.yml index 6a821b3..ad26d5c 100644 --- a/.github/workflows/issue-bot.yml +++ b/.github/workflows/issue-bot.yml @@ -40,11 +40,11 @@ jobs: (github.event_name == 'workflow_dispatch') || (github.actor != 'github-actions[bot]' && (github.event.issue.pull_request == null || github.event_name == 'pull_request_target')) - uses: sudsali/shadow/.github/workflows/shadow-review.yml@v1.7 + uses: sudsali/shadow/.github/workflows/shadow-review.yml@ed31ed7e30ef81be82d7b8b756b626f876036d73 # v1.7 with: pr_number: ${{ inputs.issue_number }} dry_run: ${{ inputs.dry_run && 'true' || 'false' }} - shadow_ref: v1.7 + shadow_ref: ed31ed7e30ef81be82d7b8b756b626f876036d73 # v1.7 aws_region: us-east-1 prompt_sm_prefix: pydeequ-bot secrets: