[mldangelo-oai]

Summary

Dependabot updated the workflow references to actions/setup-node and actions/download-artifact in #1651 and #1650. Three references in local composite actions kept the previous versions. The GitHub Actions updater scans the root action and .github/workflows when configured with /. Dependabot directory reference

Jobs that use both setup paths downloaded two revisions of setup-node on the same runner. Example main job

Changes

• Add /.github/actions/* alongside / in the existing GitHub Actions update schedule.
• Use the workflow’s setup-node v7.1.0 commit in the shared tool setup and packed Action checks, and its download-artifact v8.0.2 commit in the native download step.

Testing

• Validated the Dependabot schema and ran its upstream directory and Actions file discovery methods against the Git tree. The original configuration found 22 manifests. The change found the same 22 and all three local action manifests, with no duplicates.
• Compared the parsed action inputs and steps with the base commit, ran actionlint with ShellCheck and the configured offline zizmor scan, and passed 18 workflow tests and 45 CI selection, result verification and release progress tests.
• Ran both setup-node revisions with the three composite input combinations on Linux. They selected the same Node executables and produced the same pnpm cache keys and paths. The packed Action check made no cache requests.
• Ran the old and new download actions against a local artifact service using the same native archive. Both extracted all 14 members byte for byte to the configured directory and rejected an incorrect digest. The new action also recovered from a simulated HTTP 429.

Risk and rollout

Both revisions already run in this repository’s workflows. Their official tags and publication dates were verified against the seven-day cooldown. The shared tool setup still specifies its pnpm lockfile and the upstream cache save step still requires job success. The daily GitHub Actions update will discover the newly configured locations after merge. setup-node v7.1.0 · download-artifact v8.0.2

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T05:54:21.283113Z	c483283	PR opened
🔒 Security Review	✅ Completed 2026-10-25T05:55:04.705702Z	c483283	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks! No blocking findings in this owner-level merge-safety review. The composite pins now match the workflows, and the added Dependabot directory pattern covers all three local actions while preserving the existing update policy.

Validated the official release pins and cooldown, parsed input/step compatibility, Dependabot schema and source-derived discovery, 92 workflow/packaging contract tests, 45 CI selection/reporting tests, actionlint with ShellCheck, and the configured zizmor scan. Hosted native, package, and packed Action checks passed on this commit; broader CI is still running. The hosted Dependabot update itself remains a post-merge check.