[dependabot]

Bumps Staffbase/gha-workflows/.github/workflows/template_autodev.yml from 15.1.1 to 18.1.0.

Release notes

Sourced from Staffbase/gha-workflows/.github/workflows/template_autodev.yml's releases.

Version 18.1.0 🌈

Changes

🐛 Bug Fixes

• Revert "Update template_autodev.yml checkout with filter blob:none" @​flaxel (#522)

📝 Documentation

• 📝 Update Readme Versions @staffbase-actions[bot] (#519)

🚨 Dependencies

• chore(deps): bump launchdarkly/find-code-references from 2.17.0 to 2.18.0 @dependabot[bot] (#521)

Version 18.0.0 🌈

Changes

• fix(DEVS-1547): document missing deployments: write permission @​0x46616c6b (#518)

🚀 Features

• feat(DEVS-1547): push to GAR alongside Harbor by default @​0x46616c6b (#517)

📝 Documentation

• 📝 Update Readme Versions @staffbase-actions[bot] (#516)

Version 17.2.0 🌈

Changes

🚀 Features

• feat(DEVS-1547): add setup-artifact-registry action @​0x46616c6b (#515)
• Update template_autodev.yml checkout with filter blob:none @​monotek (#513)

📝 Documentation

• 📝 Update Readme Versions @staffbase-actions[bot] (#512)

Version 17.1.0 🌈

Changes

🚀 Features

• Update autodev-action version to v2.10.1 @​monotek (#508)

📝 Documentation

• 📝 Update Readme Versions @staffbase-actions[bot] (#507)

... (truncated)

Commits

• efb9ed9 Revert "Update template_autodev.yml checkout with filter blob:none" (#522)
• bc2ec45 chore(deps): bump launchdarkly/find-code-references (#521)
• 9673137 Merge pull request #519 from Staffbase/update-readme
• 6d5f7d5 📝 update readme versions
• f0a58ba Merge pull request #518 from Staffbase/fix-gitops-readme-deployments-permission
• e855371 fix(DEVS-1547): document missing deployments: write permission
• c8be906 Merge pull request #517 from Staffbase/DEVS-1547-gitops-v9-gar-default
• fa34173 feat(DEVS-1547): push to GAR alongside Harbor by default in template_gitops
• 91c577e Merge pull request #516 from Staffbase/update-readme
• 956d6eb 📝 update readme versions
• Additional commits viewable in compare view

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 45ca5e09-c8c3-4547-a27f-bbf273a21cbf

📥 Commits

Reviewing files that changed from the base of the PR and between e40586c and 92d34b3.

📒 Files selected for processing: 1

• .github/workflows/autodev.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Summary by CodeRabbit

• Chores
  • Updated the automated development workflow configuration to a newer template version.

Walkthrough

The Autodev job now uses template_autodev.yml v18.1.0 instead of v15.1.1. Its inputs and secrets remain unchanged.

Changes

Autodev workflow update

Layer / File(s)	Summary
Update reusable workflow reference .github/workflows/autodev.yaml	The workflow reference changes from v15.1.1 to v18.1.0. Inputs and secrets remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 92d34

The Autodev workflow update is ready for normal merge checks; no deployment-permission failure was found.

Security architecture risk: 🔵 Low · up to 92d34

The inspected update preserves credential handling, permissions, and branch-update safeguards. No new deployment authority or security defect was demonstrated. The App’s configured permissions and packaged dependency changes were not fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The unchanged token-creation configuration requests access to the current repository and inherits the App’s permissions because no permission overrides are supplied. The inspected write targets are the dev branch and repository PR feedback. Actual App privileges, the private key’s wider installation reach, and downstream deployment exposure are not established by the available configuration.

Trust Boundaries and Controls

• observed — Both workflow revisions conditionally exchange the supplied App credentials for a token and pass that token to checkout and Autodev. The job’s contents: read permission governs the workflow token, not the separately created App token. This delegated authority and credential-recipient boundary are unchanged.

Resilience and Maintainability Implications

• observed — The unchanged branch-update path snapshots the destination SHA and uses an explicit force-with-lease expectation. A rejected push returns before PR feedback updates, and failed merges are aborted locally. Branch publication and feedback remain separate operations, so interruption can leave feedback lagging; no new atomicity or recovery regression was identified.
• observed — The unchanged App-token action saves token and expiry state for post-job revocation. Cleanup skips absent or expired tokens and warns if revocation fails. Revocation is therefore best-effort rather than a guarantee under abrupt runner termination; this lifecycle behavior predates the update.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the dependency update from version 15.1.1 to 18.1.0. It matches the pull request changes.
Description check		The description accurately explains the dependency update and includes relevant release notes and commit details.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}