diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml index e913e82d6..35217d03e 100644 --- a/.github/workflows/add-to-project.yml +++ b/.github/workflows/add-to-project.yml @@ -47,11 +47,11 @@ jobs: add-to-project: permissions: contents: read - uses: combsmith/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: combsmith/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-next # NOSONAR(githubactions:S7637) first-party channel ref with: project_id: PVT_kwDOD2inqs4BZq3- project_url: https://github.com/orgs/combsmith/projects/1 - agent_ref: add-to-project/v1-stable + agent_ref: add-to-project/v1-next # Pass only the secrets the reusable declares (least privilege; avoids # `secrets: inherit` handing the reusable every org secret). secrets: diff --git a/.github/workflows/agent-shield.yml b/.github/workflows/agent-shield.yml index 96a35946f..c17a8cda5 100644 --- a/.github/workflows/agent-shield.yml +++ b/.github/workflows/agent-shield.yml @@ -31,4 +31,4 @@ permissions: jobs: agent-shield: - uses: combsmith/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: combsmith/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-next # NOSONAR(githubactions:S7637) first-party channel ref diff --git a/.github/workflows/dev-lead.yml b/.github/workflows/dev-lead.yml index af5ef105c..ca7b12bfd 100644 --- a/.github/workflows/dev-lead.yml +++ b/.github/workflows/dev-lead.yml @@ -69,9 +69,9 @@ jobs: # Promotion is done by moving the channel tags centrally; this # caller is never edited on release. agent_ref threads the same channel into # dev-lead's own scripts/prompts checkout. See https://github.com/combsmith/.github/blob/main/standards/ci-standards.md#dev-lead-agent. - uses: combsmith/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v139-ring0 # NOSONAR(githubactions:S7637) first-party channel ref + uses: combsmith/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v139-next # NOSONAR(githubactions:S7637) first-party channel ref with: - agent_ref: dev-lead/v139-ring0 + agent_ref: dev-lead/v139-next secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable permissions: contents: write