fix(ansible): refresh stale dagger defaults and let renovate manage them - #128
Merged
Conversation
call-release-artifact.yaml declared dagger-module-version: v0.2.1 and dagger-version: "0.18.10". Upstream is v0.121.0 and v0.21.7, so the module default sat about 119 releases behind - the same trap #121 fixed in call-ansible-collection.yaml, where it had sat at v0.13.0. Harmless only because every caller passes explicit values. Called without them, this workflow silently runs a module predating the monotonic version scheme and the tag-naming fix, so it would publish a release tagged with a filename and a version that can run backwards. Both pins are hand-maintained in six places across two repos and were aligned by hand three times this week, so add custom managers rather than fix the values and wait for the next drift. The existing managers key on _version: and Version:, neither of which matches these, and one of the six is a workflow_call input default where the key and the value are three lines apart. Verified with renovate's own extractor over the real files: 11 of 11 pins found across both repos, including the two stale ones here. Refs stuttgart-things/ansible#1043 (finding #8) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FDecVMyhtUtixsLmT4oLwY
patrick-hermann-sva
temporarily deployed
to
linting
July 29, 2026 13:02 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
patrick-hermann-sva
temporarily deployed
to
linting
July 29, 2026 13:14 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
patrick-hermann-sva
temporarily deployed
to
linting
July 29, 2026 13:14 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
patrick-hermann-sva
added a commit
that referenced
this pull request
Jul 29, 2026
…#129) The pin still referenced 1814f1e, which predates #127 and #128. Left alone the release path would keep calling the old workflow, so the corrected attestation verify command would never reach the release notes. Claude-Session: https://claude.ai/code/session_01FDecVMyhtUtixsLmT4oLwY Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
patrick-hermann-sva
added a commit
to stuttgart-things/ansible
that referenced
this pull request
Jul 29, 2026
* fix(renovate): manage the dagger module and cli pins The dagger module version is hardcoded in six places across two repos and was aligned by hand three times this week. Every copy currently reads v0.121.0, which is correct, but nothing watches them so they drift by default - the same shape as finding #5, which turned out to be five stale pins out of seventeen. One copy had already drifted: call-release-artifact.yaml in github-workflow-templates defaulted to v0.2.1, roughly 119 releases behind. Fixed there in stuttgart-things/github-workflow-templates#128. The existing custom managers key on _version: and Version:, so neither matches dagger-module-version: or the uppercase DAGGER_ANSIBLE_MODULE_VERSION:. One of the six is a workflow_call input default where the key and value sit three lines apart, so that form needs a multi-line match. Verified with renovate's own extractor over the real files: 7 of 7 dagger pins in this repo, 11 of 11 across both, and the role-pin manager from #1055 still returns its 7 for baseos with no interference. Refs #1043 (finding #8) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FDecVMyhtUtixsLmT4oLwY * fix(ci): bump the reusable workflow pin to pick up the release fixes The three callers pinned 627fa26, which predates github-workflow-templates #127, #128 and #129. Without this the release path keeps invoking the old workflow and consumers keep getting release notes whose attestation verify command fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FDecVMyhtUtixsLmT4oLwY --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
40 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses finding #8 of stuttgart-things/ansible#1043.
A stale default that nobody was watching
call-release-artifact.yamldeclared:This is the same trap templates#121 fixed in
call-ansible-collection.yaml, where the default had sat atv0.13.0.Harmless today only because every caller passes explicit values. Called without them, this workflow silently runs a module predating both the monotonic version scheme and the tag-naming fix — so it would publish a release tagged with a filename and a version that can run backwards. Exactly the two bugs findings #1 and #3 were about.
Why a Renovate manager, not just new values
These pins live in six places across two repos:
Taskfile.yamlpr-collection-build.yamlmain-collection-build.yamldispatch-collection-build.ymlcall-ansible-collection.yamlcall-release-artifact.yamlThey were aligned by hand three separate times this week. Fixing the values without automating them just resets the clock.
The existing custom managers key on
_version:andVersion:— neither matchesdagger-module-version:orDAGGER_ANSIBLE_MODULE_VERSION:. And one of the six is aworkflow_callinput default, where the key and the value are three lines apart, so it needs a multi-line match.Verification
Ran Renovate's own regex extractor over the real files in both repos — 11 of 11 pins found, including the two stale ones:
renovate-config-validatorpasses;check-jsonschemapasses on the workflow.The companion PR adds the same managers to the ansible repo.
🤖 Generated with Claude Code
https://claude.ai/code/session_01FDecVMyhtUtixsLmT4oLwY