chore(deps): update ferrlabs/.github digest to e89ec12

[ferrlabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
FerrLabs/.github (changelog)	workflow	digest	4215a84 → e89ec12

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[ferrfleet]

Two digest/version bumps, both uneventful for this repo.

FerrLabs/.github 4215a84→ce6349b: pulls in two upstream fixes — (1) reusable-security-scan.yml now defaults run-on-private: true and adds a scanned gate that fails if every scan job was skipped. security-scan.yml:9 already sets run-on-private: true, and this run's "Scans ran" check is green, so no behavior change here. (2) reusable-ci-go.yml's sonarqube job now requests job-level pull-requests: write so it can comment on PRs.

Nit: that second fix needs the caller to also grant the permission — the reusable workflow's own comment says so explicitly ("l'appelant doit accorder la même permission... sinon il n'y a rien à transmettre"). ci.yml's ci job (which sets enable-sonar: true) has no permissions: block, so nothing is passed down and the SonarQube job's PR-comment step will still fail to get write access. Not a regression from this bump though — before this fix the job had no permission override at all and was capped at contents: read by the reusable workflow's own top-level permissions: block, so it was already broken pre-bump. To actually benefit from the upstream fix, add to .github/workflows/ci.yml:

  ci:
    name: CI
    permissions:
      contents: read
      pull-requests: write
    uses: FerrLabs/.github/.github/workflows/reusable-ci-go.yml@ce6349be15283fedc44fc17f74555f3b598ebbab # main

FerrLabs/FerrFlow v6.1.1→v6.2.0: adds workspace.releaseCommitBody (opt-in changelog-in-commit feature). No breaking changes, and publish.yml:61 only uses mode: publish, which isn't affected.

CI: gitleaks/osv-scanner/zizmor/opengrep/snyk/"Scans ran"/Conventional commits are all green on this head commit; kind smoke test and the CI (lint/test/build/SonarQube) job hadn't reported yet at review time — no failure signal from the bump so far.

[github-actions]

SonarQube — aucune nouvelle issue

_{Comparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail}

[ferrfleet]

Follow-up on this rebased head. Two things changed since my last review, both good:

1. The Nit I raised (missing pull-requests: write passthrough for the SonarQube reusable job) is now fixed — ci.yml on main picked up FerrVault#222 (432a7211), which added the permissions: block. This PR's rebase carries it, and it's not part of this PR's own diff.
2. FerrLabs/.github digest moved further (ce6349b→f14308c) as Renovate kept rebasing while the PR sat open. Checked the intervening commits (#219–#226 on FerrLabs/.github): all self-referential digest bumps and renovate-config/Kellnr changes, nothing touching reusable-ci-go.yml, reusable-ferrflow-release.yml, reusable-renovate-dispatch.yml, reusable-sbom-track.yml, or reusable-security-scan.yml. No new behavior for this repo.

FerrFlow bump (v6.1.1→v6.2.0) is unchanged from before: adds opt-in workspace.releaseCommitBody, not used by publish.yml:61 (mode: publish only).

CI was still pending/in-progress at review time (no failures observed); scan jobs (gitleaks/osv-scanner/zizmor/snyk) are green as before. No blocking findings.

[ferrfleet]

Follow-up on this rebased head. Since my last review (f47ab42d, FerrFlow v7.0.5 / .github digest 67e9379), the branch has been rebased repeatedly and both pins moved a lot further:

• FerrFlow direct pin (publish.yml): v7.0.5→v7.8.1. Checked every release note in between (v7.1.0–v7.8.1) — no BREAKING entries, all features (latestTag, api-check, pypi publisher, versionTemplate, config include, plan --interactive, etc.) or bug fixes. publish.yml:61 still only uses mode: publish with docker+helm publishers (per .ferrflow); none of the npm/pypi/OIDC-publish changes apply. The one item worth naming: v7.3.1 added npm trusted publishing over OIDC — irrelevant here since this repo has no npm publisher.
• .github digest: 67e9379→93b84d0, pulling the same FerrFlow range into reusable-ferrflow-release.yml (now pinned v7.8.0, was v7.0.2) plus unrelated repo-hygiene commits (LF normalisation, renovate docker-auth fix, cargo --locked/env-flag CI tweaks, github-script v9). Diffed reusable-ci-go.yml (byte-identical) and reusable-security-scan.yml (only the codeql-action/upload-sarif pin moved, same v4) between the two digests — no behavior change reaches this repo.
• The FerrFlow v7 commitFormats leniency Nit from my earlier review is still open and unchanged — not repeating it.

CI: all 21 checks green on this head commit (Build, Test, Lint, Security, SonarQube, kind smoke test, gitleaks/osv-scanner/zizmor/opengrep/snyk, PR title). No blocking findings.

[ferrfleet]

Follow-up on this rebased head (f47ab42d→c919180). Changes since my last review:

1. FerrFlow direct pin (publish.yml): v7.0.5→v7.8.1 — a run of additive minor features (versionTemplate, workspace.latestTag, version-source reporting, per-package config include, api-check, a pypi publisher, graph, interactive plan, repeatable --force-version/--exclude) plus bug fixes. No breaking changes. publish.yml:61 still only uses mode: publish, unaffected by any of them.

2. FerrLabs/.github digest moved 67e9379→d7083e2, which bumps the FerrFlow pin inside reusable-ferrflow-release.yml (backs this repo's release.yml) in lockstep, v7.0.2→v7.8.1 — now aligned with the direct pin. Checked that workflow: FerrVault's release job doesn't set mode: pr, so v7.8.0's "tag on merge instead of the pre-bump commit" PR-mode fix is a no-op here.

The FerrFlow v7 commitFormats leniency Nit from my first review is still open and unchanged — not repeating it.

CI: all 19 checks green (Build, Test, Lint, Security, SonarQube, kind smoke test, gitleaks/osv-scanner/zizmor/opengrep/snyk, PR title). No blocking findings.

[ferrfleet]

Follow-up on this rebased head. Since my last review (commit f47ab42d), the FerrLabs/.github digest moved 67e9379→c34090d (~30 upstream commits, Aug 15–27).

Diffed all 6 reusable workflows FerrVault calls at both SHAs:

• reusable-ci-go.yml, reusable-pr-title.yml, reusable-renovate-dispatch.yml, reusable-sbom-track.yml — byte-identical, no changes.
• reusable-security-scan.yml — only a patch-level codeql-action/upload-sarif digest refresh across the 5 SARIF-upload steps. No input/permission/runner changes.
• reusable-ferrflow-release.yml (backs release.yml) — the internal FerrLabs/FerrFlow action pin moved v7.0.2→v7.9.0. Checked all 20 intervening release notes: no BREAKING CHANGE entries. The few behavior-relevant changes (new workspace.versionSource config defaulting to today's highest behavior; extended token-stripping for non-GitHub hosts; a releaseCommitMode: "pr" tag-timing fix) all require opt-in config or non-GitHub hosting that FerrVault doesn't use — confirmed FerrVault has no ferrflow.json/.ferrflow.json, so it runs on defaults throughout.

Net: this is a routine transitive digest refresh, nothing new for FerrVault's mode: release usage beyond the already-flagged (and still-open, not repeating) v7.0.0 commitFormats leniency Nit.

CI: gitleaks/osv-scanner/zizmor/snyk/opengrep/Scans-ran/Lint/Test/Security/PR-title all green on this head. Build, SonarQube analysis, and kind smoke test were still in progress at review time with no failures observed. No blocking findings.

[ferrfleet]

Follow-up on this rebased head. FerrLabs/.github digest moved 67e9379→62a681d (~29 upstream commits over 12 days). Checked all 5 reusable workflows FerrVault actually uses:

• reusable-ci-go.yml, reusable-renovate-dispatch.yml: byte-identical, no change.
• reusable-pr-title.yml: runner input default changed from hardcoded ferrlabs-k8s-light to auto-select (falls back to ubuntu-latest for public repos instead of hanging). FerrVault doesn't override runner, so this only helps (or is a no-op if private).
• reusable-ferrflow-release.yml: only its internal FerrLabs/FerrFlow action pin moved v7.0.2→v7.9.0. Checked all 8 intervening release notes — no new BREAKING CHANGE entries beyond the already-known v7.0.0 commitFormats leniency Nit (previously reported, still open, not repeating it).
• reusable-security-scan.yml: only a codeql-action/upload-sarif digest refresh within v4, no input/default changes; run-on-private still defaults true, matching security-scan.yml:9.

Also checked commit #266 (removes a reusable SBOM-publish workflow) — FerrVault never referenced it (sbom doesn't appear in any of its workflows), so not applicable.

CI: all checks green (Build, Test, Lint, Security, SonarQube, kind smoke test, gitleaks/osv-scanner/zizmor/opengrep/snyk, PR title). No blocking findings.

[ferrfleet]

Follow-up on this rebased head. Since my last review (commit f47ab42d), FerrLabs/.github digest moved 67e9379→34983fe (30 commits, #260→#300):

• FerrFlow pin inside reusable-ferrflow-release.yml (backs release.yml) jumped v7.0.2→v7.11.1. Checked all 10 intervening minor releases (v7.1.0–v7.11.0): all additive features (new CLI subcommands, opt-in config keys, new publishers) and bug fixes, none marked breaking. publish.yml still only uses mode: publish, unaffected. The v7.0.0 commitFormats leniency Nit I raised earlier is unchanged — not repeating it.
• reusable-pr-title.yml gained runner auto-selection by repo visibility — FerrVault's pr-title.yml already passes runner: ubuntu-latest explicitly, so this is a no-op here.
• The removed reusable SBOM-publish workflow and the Rust cargo-flag/--locked changes target files/workflows FerrVault doesn't use (no sbom.yml, and ci.yml uses reusable-ci-go.yml, not the Rust one).

No blocking findings. CI: all relevant checks green (Lint, Security, gitleaks/osv-scanner/zizmor/snyk/opengrep, PR title); Test and kind smoke test still in progress at review time with no failures observed.

[ferrfleet]

Follow-up on this rebased head. Since my last review (commit f47ab42), FerrLabs/.github digest moved 67e9379→340c925, pulling in ~30 commits. Diffed the five reusable workflows this repo actually calls between those two SHAs:

• reusable-ci-go.yml: only the detect job's default private-repo runner moved to ferrlabs-k8s-light (light runner, no build). No effect on lint/test/build.
• reusable-security-scan.yml: only the upload-sarif action digest bumped (codeql-action v4). No behavior change.
• reusable-pr-title.yml: the runner input's default changed (ferrlabs-k8s-light → auto-select by visibility), but FerrVault's pr-title.yml already pins runner: ubuntu-latest explicitly, so this repo is unaffected either way.
• reusable-ferrflow-release.yml: FerrFlow pin bumped v7.0.2→v7.11.1 (backs release.yml). Read all 30 intervening release notes (v7.0.3 through v7.11.2) — all features are opt-in/config-gated (versionTemplate, api-check, pypi publisher, rollback, calver, etc.) or internal fixes (git/publish/docker robustness). No default-behavior break found; the v7.0.0 commitFormats leniency Nit I raised earlier is unrelated and unchanged.
• reusable-renovate-dispatch.yml: byte-identical, no change.

No blocking findings. CI: all completed checks green (Lint, Test, Security, gitleaks/osv-scanner/zizmor/snyk/opengrep, Scans ran, PR title); kind smoke test and CI / Build + CI / SonarQube were still in progress at review time with no failures observed.

[ferrfleet]

Follow-up on this rebased head. Since my last review (commit f47ab42), FerrLabs/.github digest moved 67e9379→a5886d74. Checked every intervening commit (#282–#303) for anything touching the reusable workflows this repo calls:

• reusable-ferrflow-release.yml: the pinned FerrFlow action moved v7.0.2→v7.11.1. Read every release note in between (v7.0.3 through v7.11.1) — all additive opt-in features (workspace.latestTag, versionTemplate, ferrflow graph, ferrflow rollback, per-package config, etc.) or bug fixes; no default-behavior or breaking change. release.yml only passes dry-run, unaffected. The previously-flagged Nit (v7.0.0's more lenient commitFormats default) is unchanged in this range — not repeating it.
• reusable-pr-title.yml (#295/#293): now auto-selects the runner by repo visibility instead of always ubuntu-latest. pr-title.yml:23 already pins runner: ubuntu-latest explicitly, so this repo is unaffected.
• reusable-security-scan.yml (#303): opengrep ruleset is now fetched via HTTPS/tarball instead of git clone — internal implementation detail, no input/output change. Confirmed green (Secrets + CVE / opengrep (SAST)).
• #302: five no-build helper jobs (across reusable-ci-go.yml, reusable-ci-rust.yml, reusable-docker-build.yml, reusable-ferrflow-release.yml) moved to the light runner tier — pure infra/cost change.

Nothing else in the range (#282–#303) touches a workflow FerrVault calls.

CI: all 19 checks green (Build, Lint, Test, Security, SonarQube, kind smoke test, gitleaks/osv-scanner/zizmor/opengrep/snyk, Scans ran). No blocking findings.

[ferrfleet]

Follow-up on this rebased head. Since my last review (FerrLabs/.github digest 67e9379), the digest moved further to 71acd9a (~30 commits). Checked every commit in that range against the 5 reusable workflows FerrVault actually uses:

• reusable-ci-go.yml, reusable-renovate-dispatch.yml: no caller-visible change (reusable-renovate-dispatch.yml untouched entirely; ci-go's only change is a private-repo runner-tier switch for the detect job, same job name).
• reusable-pr-title.yml: runner input default changed to auto-select, but FerrVault's pr-title.yml passes runner: ubuntu-latest explicitly, so the new fallback logic never triggers — no effect.
• reusable-ferrflow-release.yml: pinned FerrFlow action moved v7.0.2→v7.11.1. Checked all 25 intervening release notes — Features/Bug Fixes only, no new BREAKING entries beyond the already-flagged v7.0.0 commitFormats leniency (still open, not repeating it).
• reusable-security-scan.yml: opengrep ruleset fetch switched from git clone to curl codeload.github.com + tar — same output, no new input/secret.

No renamed/removed jobs, no new required inputs/secrets/permissions, no required-check renames — nothing here should break FerrVault's CI or branch protection.

Nit: FerrFlow v7.9.0 switched release-commit authoring to GraphQL createCommitOnBranch (verified commits) — changelog doesn't call it breaking, but worth a quick sanity check that FerrVault's next release run still produces the expected signed commit.

Nit: the opengrep fetch now needs codeload.github.com reachable instead of github.com — if FerrVault's self-hosted runner has an egress allowlist, worth confirming it covers the new host.

CI: gitleaks/osv-scanner/zizmor/snyk/opengrep/Scans ran/Lint/Test/Security/kind smoke test all green on this head commit. Build and SonarQube analysis were still in progress at review time, no failures observed. No blocking findings.

[ferrfleet]

Follow-up on this rebased head — a large gap since my last review (f47ab42d, 2026-08-16), so re-checked the full delta.

FerrLabs/.github digest 67e9379→3df97ce (17 days, ~25 commits): the only functionally relevant changes for FerrVault's callers:

• reusable-ci-go.yml's sonarqube job now delegates to a separate reusable-sonarqube-scan.yml@2883414f (was inline before), still requiring job-level pull-requests: write passthrough from the caller. ci.yml:9-12 already carries that block (added back in FerrVault#222, confirmed present at this head), and this run's "CI / SonarQube" check is green — no action needed.
• reusable-ferrflow-release.yml's FerrFlow pin (backs release.yml) advanced v7.0.2→v7.11.1. Checked every release note v7.0.5→v7.15.1 for Breaking Changes: none — the only breaking entry in range is the v7.0.0 commitFormats leniency I already flagged as a Nit previously (unchanged, not repeating).
• reusable-pr-title.yml, reusable-security-scan.yml (opengrep ruleset now fetched via HTTPS tarball instead of git clone, some helper jobs moved to a lighter runner tier), reusable-renovate-dispatch.yml: no changes affecting this repo's usage.

No blocking findings. CI: all checks green (Build, Test, Lint, Security, SonarQube, kind smoke test, gitleaks/osv-scanner/zizmor/opengrep/snyk, PR title).

[ferrfleet]

Follow-up on this rebased head. Since my last review (commit f47ab42d, digest 67e9379), FerrLabs/.github digest moved to e89ec1209ae561a7a1b910127ccbd926e77fa613. The notable change: the FerrFlow action pinned inside reusable-ferrflow-release.yml (backs this repo's release.yml) jumped v7.0.2→v7.11.1. Read all intervening release notes (v7.1.0–v7.11.1) — all minor/patch features and bug fixes, no breaking changes listed. The two entries that touch behavior gated behind flags this repo doesn't set (fix(release): pr mode tag on merge #936, needs mode: pr; the trigger-renovate job's runner relabel) don't apply — FerrVault's release.yml uses default release mode + mode: publish, no deferred-publish/trigger-renovate.

Other changes in this digest bump, both no-op for FerrVault:

• reusable-security-scan.yml: opengrep ruleset fetch switched from git clone to curl+tar (upstream reliability fix), plus a routine codeql-action/upload-sarif digest bump.
• reusable-ci-go.yml / the release workflow's trigger-renovate job: private-repo runner relabeled ferrlabs-k8s→ferrlabs-k8s-light (infra-side, not this repo's concern).

The FerrFlow v7 commitFormats leniency Nit I raised earlier is still open and unchanged — not repeating it here.

CI: all green (Lint, Test, Security, gitleaks/osv-scanner/zizmor/opengrep/snyk, Scans ran, Conventional commits) except CI / Build, CI / SonarQube analysis, and kind smoke test, still in progress at review time with no failures observed. No blocking findings.