ci(deps): bump complytime/org-infra/.github/workflows/reusable_ci.yml from 0.8.0 to 0.9.0 by dependabot[bot] · Pull Request #245 · complytime/.github

dependabot · 2026-10-29T07:43:40Z

Bumps complytime/org-infra/.github/workflows/reusable_ci.yml from 0.8.0 to 0.9.0.

Release notes

Sourced from complytime/org-infra/.github/workflows/reusable_ci.yml's releases.

v0.9.0

org-infra 0.9.0

Central reusable GitHub Actions workflows, CI templates, compliance policy assets, and org sync tooling. Downstream repos usually consume this repo via workflow uses: pins or version tags.

Before you upgrade

Treat workflow YAML updates as potentially breaking for every consumer until you’ve reviewed them.

Use the Workflows & GitHub Actions section below for PRs that touched pipelines; for exact paths and hunks, open the compare link and narrow Files changed to .github/workflows/.

View full diff: v0.8.0 → v0.9.0

Changes

chore: remove Go and Python sync targets for cleaned-up repos — #586 · @marcusburghardt

feat(ci): clear Size on epic issues on the planning board — #589 · @beatrizmcouto

feat: add reusable CodeQL workflow with Go version management — #585 · @marcusburghardt

fix: correct sync interval docs and add label-only epic test — #591 · @marcusburghardt

feat: sync compliance targets with peribolos — #570 · @marcusburghardt

fix: use indented YAML sequences in compliance target sync — #603 · @marcusburghardt

chore: sync compliance targets with peribolos — #604 · @github-actions[bot]

ci: pin council review action to v0.18.0 — #624 · @yvonnedevlinrh

fix(ci): resolve Go version mismatch in compliance workflow — #628 · @marcusburghardt

chore: archive 20 completed openspec changes and sync delta specs — #627 · @marcusburghardt

feat: add pinact action version verification to reusable CI — #638 · @marcusburghardt

fix: restructure complypack publish pipeline for tag-based Quay promotion — #630 · @marcusburghardt

docs: add SonarCloud setup and onboarding guide — #675 · @marcusburghardt

fix(ci): correct coverage artifact download path in SonarCloud workflow — #687 · @marcusburghardt

feat: add when guards to ampel branch-protection policies — #686 · @marcusburghardt

fix: harden lint-policies validation and add regression tests — #691 · @marcusburghardt

chore: archive all completed openspec changes and close legacy specs — #692 · @marcusburghardt

Features

docs: update stale command references post uf.* namespace migration — #588 · @marcusburghardt

chore: bump complyctl to v1.0.0 and providers to v0.2.1 — #625 · @marcusburghardt

refactor: extract GitHubActionsLoader into tests/conftest.py — #663 · @rahemoth

Maintenance

chore(deps): bump gitpython from 3.1.61 to 3.1.62 — #593 · @dependabot[bot]

ci(deps): bump complytime/org-infra/.github/workflows/reusable_security.yml from 0.7.1 to 0.8.0 — #596 · @dependabot[bot]

ci(deps): bump renovatebot/github-action from 46.2.6 to 46.3.0 — #595 · @dependabot[bot]

ci(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 — #597 · @dependabot[bot]

chore(deps): bump ruff from 0.16.6 to 0.16.7 — #592 · @dependabot[bot]

chore(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.6 to 0.16.7 — #594 · @dependabot[bot]

ci(deps): bump github/codeql-action/autobuild from 4.37.9 to 4.38.0 — #601 · @dependabot[bot]

ci(deps): bump github/codeql-action/analyze from 4.37.9 to 4.38.0 — #600 · @dependabot[bot]

... (truncated)

Commits

8f347ba Merge pull request #692 from marcusburghardt/chore/archive-openspec-changes
d89deec chore: archive all completed openspec changes and close legacy specs
d913a9a Merge pull request #691 from marcusburghardt/fix/lint-policies-robustness
9030eaf test(lint-policies): add negative integration tests for Makefile target
0d3852e test: add regression tests for lint-policies validation
13aeaae fix: use exact URL matching in lint-policies validation
fe103c1 fix: add error propagation to lint-policies Makefile target
7892761 Merge pull request #674 from complytime/dependabot/github_actions/unbound-for...
97a5176 ci(deps): bump unbound-force/unbound-force/council-review-action
431c306 Merge pull request #690 from complytime/dependabot/github_actions/step-securi...
Additional commits viewable in compare view

github-actions · 2026-10-29T07:44:04Z

🤖 Standardized Dependabot Review Summary 🤖

This PR was processed by the organization's reusable CI pipeline.

Criterion	Status	Detail
Dependencies Review	success	View logs
Calculated Risk	medium	`complytime/org-infra/.github/workflows/reusable_ci.yml` v0.9.0
Release Age	70h	Released 70 hours ago
Ownership	org-owned	Same organization — trusted source
Dependency Usage	2 repos	Informational only — does not affect approval

Auto-approval: ✅ Approved + auto-merge requested (org-owned)

Maintainer check list:

Ensure the PR passed all CI tests (required status checks).
Investigate failures for Major updates or any manual review requirement.
Don't overlook breaking changes and changelog information.
If the scorecard value is low, consider to contribute to make it higher. Everybody wins!
Be diligent. When in doubt, ask another maintainer for additional review.

github-actions

Automatically approved: risk=medium, review=success, ownership=org-owned, release_age=skipped (org-owned).

github-actions · 2026-10-29T07:44:07Z

CRAP Load Analysis

No Go code changes detected in this PR. No CRAP impact.

github-actions · 2026-10-29T09:57:31Z

🤖 Standardized Dependabot Review Summary 🤖

This PR was processed by the organization's reusable CI pipeline.

Criterion	Status	Detail
Dependencies Review	success	View logs
Calculated Risk	medium	`complytime/org-infra/.github/workflows/reusable_ci.yml` v0.9.0
Release Age	73h	Released 73 hours ago
Ownership	org-owned	Same organization — trusted source
Dependency Usage	2 repos	Informational only — does not affect approval

Auto-approval: ✅ Approved + auto-merge requested (org-owned)

Maintainer check list:

Ensure the PR passed all CI tests (required status checks).
Investigate failures for Major updates or any manual review requirement.
Don't overlook breaking changes and changelog information.
If the scorecard value is low, consider to contribute to make it higher. Everybody wins!
Be diligent. When in doubt, ask another maintainer for additional review.

github-actions

Automatically approved: risk=medium, review=success, ownership=org-owned, release_age=skipped (org-owned).

github-actions · 2026-10-29T09:58:41Z

🤖 Standardized Dependabot Review Summary 🤖

This PR was processed by the organization's reusable CI pipeline.

Criterion	Status	Detail
Dependencies Review	success	View logs
Calculated Risk	medium	`complytime/org-infra/.github/workflows/reusable_ci.yml` v0.9.0
Release Age	73h	Released 73 hours ago
Ownership	org-owned	Same organization — trusted source
Dependency Usage	2 repos	Informational only — does not affect approval

Auto-approval: ✅ Approved + auto-merge requested (org-owned)

Maintainer check list:

Ensure the PR passed all CI tests (required status checks).
Investigate failures for Major updates or any manual review requirement.
Don't overlook breaking changes and changelog information.
If the scorecard value is low, consider to contribute to make it higher. Everybody wins!
Be diligent. When in doubt, ask another maintainer for additional review.

github-actions

Automatically approved: risk=medium, review=success, ownership=org-owned, release_age=skipped (org-owned).

marcusburghardt

LGTM

github-actions · 2026-10-29T10:02:29Z

🤖 Standardized Dependabot Review Summary 🤖

This PR was processed by the organization's reusable CI pipeline.

Criterion	Status	Detail
Dependencies Review	success	View logs
Calculated Risk	medium	`complytime/org-infra/.github/workflows/reusable_ci.yml` v0.9.0
Release Age	73h	Released 73 hours ago
Ownership	org-owned	Same organization — trusted source
Dependency Usage	2 repos	Informational only — does not affect approval

Auto-approval: ✅ Approved + auto-merge requested (org-owned)

Maintainer check list:

Ensure the PR passed all CI tests (required status checks).
Investigate failures for Major updates or any manual review requirement.
Don't overlook breaking changes and changelog information.
If the scorecard value is low, consider to contribute to make it higher. Everybody wins!
Be diligent. When in doubt, ask another maintainer for additional review.

github-actions

Automatically approved: risk=medium, review=success, ownership=org-owned, release_age=skipped (org-owned).

Bumps [complytime/org-infra/.github/workflows/reusable_ci.yml](https://github.com/complytime/org-infra) from 0.8.0 to 0.9.0. - [Release notes](https://github.com/complytime/org-infra/releases) - [Changelog](https://github.com/complytime/org-infra/blob/main/CHANGELOG.md) - [Commits](complytime/org-infra@bd3718a...8f347ba) --- updated-dependencies: - dependency-name: complytime/org-infra/.github/workflows/reusable_ci.yml dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

github-actions · 2026-10-29T10:04:25Z

🤖 Standardized Dependabot Review Summary 🤖

This PR was processed by the organization's reusable CI pipeline.

Criterion	Status	Detail
Dependencies Review	success	View logs
Calculated Risk	medium	`complytime/org-infra/.github/workflows/reusable_ci.yml` v0.9.0
Release Age	73h	Released 73 hours ago
Ownership	org-owned	Same organization — trusted source
Dependency Usage	2 repos	Informational only — does not affect approval

Auto-approval: ✅ Approved + auto-merge requested (org-owned)

Maintainer check list:

Ensure the PR passed all CI tests (required status checks).
Investigate failures for Major updates or any manual review requirement.
Don't overlook breaking changes and changelog information.
If the scorecard value is low, consider to contribute to make it higher. Everybody wins!
Be diligent. When in doubt, ask another maintainer for additional review.

github-actions

Automatically approved: risk=medium, review=success, ownership=org-owned, release_age=skipped (org-owned).

sonarqubecloud · 2026-10-29T10:04:27Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-10-29T10:04:27Z

🤖 Standardized Dependabot Review Summary 🤖

This PR was processed by the organization's reusable CI pipeline.

Criterion	Status	Detail
Dependencies Review	success	View logs
Calculated Risk	medium	`complytime/org-infra/.github/workflows/reusable_ci.yml` v0.9.0
Release Age	73h	Released 73 hours ago
Ownership	org-owned	Same organization — trusted source
Dependency Usage	2 repos	Informational only — does not affect approval

Auto-approval: ✅ Approved + auto-merge requested (org-owned)

Maintainer check list:

Ensure the PR passed all CI tests (required status checks).
Investigate failures for Major updates or any manual review requirement.
Don't overlook breaking changes and changelog information.
If the scorecard value is low, consider to contribute to make it higher. Everybody wins!
Be diligent. When in doubt, ask another maintainer for additional review.

github-actions

Automatically approved: risk=medium, review=success, ownership=org-owned, release_age=skipped (org-owned).

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 29, 2026

dependabot Bot requested review from gxmiranda, jflowers, jpower432 and marcusburghardt as code owners October 29, 2026 07:43

github-actions Bot approved these changes Oct 29, 2026

View reviewed changes

github-actions Bot enabled auto-merge (squash) October 29, 2026 07:44

dependabot Bot force-pushed the dependabot/github_actions/complytime/org-infra/dot-github/workflows/reusable_ci.yml-0.9.0 branch from 6c867de to d4429f3 Compare October 29, 2026 09:56

github-actions Bot approved these changes Oct 29, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/github_actions/complytime/org-infra/dot-github/workflows/reusable_ci.yml-0.9.0 branch from d4429f3 to 0942c9f Compare October 29, 2026 09:58

github-actions Bot approved these changes Oct 29, 2026

View reviewed changes

marcusburghardt approved these changes Oct 29, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/github_actions/complytime/org-infra/dot-github/workflows/reusable_ci.yml-0.9.0 branch from 0942c9f to d290592 Compare October 29, 2026 10:01

github-actions Bot approved these changes Oct 29, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/github_actions/complytime/org-infra/dot-github/workflows/reusable_ci.yml-0.9.0 branch from d290592 to 4581843 Compare October 29, 2026 10:04

github-actions Bot approved these changes Oct 29, 2026

View reviewed changes

github-actions Bot merged commit 592b9fd into main Oct 29, 2026
29 of 31 checks passed

github-actions Bot deleted the dependabot/github_actions/complytime/org-infra/dot-github/workflows/reusable_ci.yml-0.9.0 branch October 29, 2026 10:04

Conversation

dependabot Bot commented on behalf of github Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.9.0

org-infra 0.9.0

Before you upgrade

Changes

Features

Maintenance

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 29, 2026

CRAP Load Analysis

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

marcusburghardt left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Oct 29, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited

Loading