Summary
update-packages.yml fails at job setup in every consuming repository because its actions are pinned to floating tags, and the organization now requires full-length commit SHA pins.
Evidence
Every scheduled run in Cratis/AI has failed since 2026-08-27. Green through 2026-08-26, then 8 consecutive failures:
| Date |
Conclusion |
| 2026-08-26 and earlier |
success |
| 2026-08-27 → 2026-09-03 |
failure (8 consecutive) |
Latest failing run: https://github.com/Cratis/AI/actions/runs/33732590402
The job fails in 3 seconds at Set up job — the workflow body never executes. Annotation:
The actions actions/checkout@v4, actions/setup-dotnet@v4, actions/setup-node@v4, actions/setup-java@v4, and erlef/setup-beam@v1 are not allowed in Cratis/AI because all actions must be pinned to a full-length commit SHA.
Root cause
.github/workflows/update-packages.yml in this repository:
| Line |
Unpinned reference |
| 44 |
actions/checkout@v4 |
| 99 |
actions/setup-dotnet@v4 |
| 111 |
actions/setup-node@v4 |
| 121 |
actions/setup-java@v4 |
| 128 |
erlef/setup-beam@v1 |
Consuming repositories call this via Cratis/.github/.github/workflows/update-packages.yml, which delegates to Cratis/Workflows/.github/workflows/update-packages.yml@main. The failure therefore reproduces anywhere the shared workflow is used — Cratis/AI is where it was observed, not the only affected repository.
Impact
Automated dependency updates have been silently dead for over a week across every consuming repository. Because the job fails during setup rather than during execution, there is no partial run and no update PR — the failure is easy to miss.
Suggested fix
Pin all five actions to full-length commit SHAs with the version as a trailing comment, then audit the other workflows in this repository for the same pattern before the policy breaks them too.
Verification
Re-run Update Packages in a consuming repository and confirm it advances past Set up job.
Found during a read-only triage of Cratis/AI issues and PRs. No workflow, run, or file was modified.
Summary
update-packages.ymlfails at job setup in every consuming repository because its actions are pinned to floating tags, and the organization now requires full-length commit SHA pins.Evidence
Every scheduled run in
Cratis/AIhas failed since 2026-08-27. Green through 2026-08-26, then 8 consecutive failures:Latest failing run: https://github.com/Cratis/AI/actions/runs/33732590402
The job fails in 3 seconds at
Set up job— the workflow body never executes. Annotation:Root cause
.github/workflows/update-packages.ymlin this repository:actions/checkout@v4actions/setup-dotnet@v4actions/setup-node@v4actions/setup-java@v4erlef/setup-beam@v1Consuming repositories call this via
Cratis/.github/.github/workflows/update-packages.yml, which delegates toCratis/Workflows/.github/workflows/update-packages.yml@main. The failure therefore reproduces anywhere the shared workflow is used —Cratis/AIis where it was observed, not the only affected repository.Impact
Automated dependency updates have been silently dead for over a week across every consuming repository. Because the job fails during setup rather than during execution, there is no partial run and no update PR — the failure is easy to miss.
Suggested fix
Pin all five actions to full-length commit SHAs with the version as a trailing comment, then audit the other workflows in this repository for the same pattern before the policy breaks them too.
Verification
Re-run
Update Packagesin a consuming repository and confirm it advances pastSet up job.Found during a read-only triage of
Cratis/AIissues and PRs. No workflow, run, or file was modified.