Bump senzing-factory/build-resources/.github/workflows/add-to-project-dependabot.yaml from 3 to 4

[dependabot]

Bumps senzing-factory/build-resources/.github/workflows/add-to-project-dependabot.yaml from 3 to 4.

Release notes

Sourced from senzing-factory/build-resources/.github/workflows/add-to-project-dependabot.yaml's releases.

4.0.0

What's Changed

• #260 make shared workflows generic, misc cleanup by @​kernelsam in senzing-factory/build-resources#261

Full Changelog: senzing-factory/build-resources@v3...4.0.0

3.0.31

What's Changed

• Bump super-linter/super-linter from 8.4.0 to 8.5.0 by @​dependabot[bot] in senzing-factory/build-resources#257
• if the PR's REFRESHED_AT matches main's value, it only passes if that… by @​kernelsam in senzing-factory/build-resources#259

Full Changelog: senzing-factory/build-resources@v3...3.0.31

3.0.30

What's Changed

• Bump super-linter/super-linter from 8.3.1 to 8.3.2 by @​dependabot[bot] in senzing-factory/build-resources#254
• Bump actions/download-artifact from 6 to 7 by @​dependabot[bot] in senzing-factory/build-resources#250
• Bump super-linter/super-linter from 8.3.2 to 8.4.0 by @​dependabot[bot] in senzing-factory/build-resources#255
• Bump actions/upload-artifact from 5 to 6 by @​dependabot[bot] in senzing-factory/build-resources#249
• Fix regex for filtering GitHub workflows by @​kernelsam in senzing-factory/build-resources#256

Full Changelog: senzing-factory/build-resources@v3...3.0.30

3.0.29

What's Changed

• Bump super-linter/super-linter from 8.3.0 to 8.3.1 by @​dependabot[bot] in senzing-factory/build-resources#252
• Remove validation for natural language in workflows by @​kernelsam in senzing-factory/build-resources#253

Full Changelog: senzing-factory/build-resources@v3...3.0.29

3.0.28

What's Changed

• Add Markdown formatting guidelines to PR template by @​kernelsam in senzing-factory/build-resources#244
• Enhance PR review instructions for local and GitHub by @​kernelsam in senzing-factory/build-resources#246
• 247 dockter 1 by @​docktermj in senzing-factory/build-resources#248

New Contributors

• @​docktermj made their first contribution in senzing-factory/build-resources#248

Full Changelog: senzing-factory/build-resources@v3...3.0.28

3.0.27

Full Changelog: senzing-factory/build-resources@v3...3.0.27

3.0.26

Full Changelog: senzing-factory/build-resources@v3...3.0.26

... (truncated)

Changelog

Sourced from senzing-factory/build-resources/.github/workflows/add-to-project-dependabot.yaml's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, markdownlint, and this project adheres to Semantic Versioning.

[Unreleased]

• Thing 5
• Thing 4

[1.0.1] - yyyy-mm-dd

Added to 1.0.1

• Thing 3

Fixed in 1.0.1

• Thing 2

[1.0.0] - yyyy-mm-dd

Added to 1.0.0

• Thing 2
• Thing 1

Commits

• 52eb86b bump tags to v4, slack channel override, missing claude settings (#262)
• 08fb769 #260 make shared workflows generic, misc cleanup (#261)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Resolves #260
Resolves #262
Resolves #261
Resolves senzing-factory/build-resources#261
Resolves senzing-factory/build-resources#257
Resolves senzing-factory/build-resources#259
Resolves senzing-factory/build-resources#254
Resolves senzing-factory/build-resources#250
Resolves senzing-factory/build-resources#255
Resolves senzing-factory/build-resources#249
Resolves senzing-factory/build-resources#256
Resolves senzing-factory/build-resources#252
Resolves senzing-factory/build-resources#253
Resolves senzing-factory/build-resources#244
Resolves senzing-factory/build-resources#246
Resolves senzing-factory/build-resources#248

[github-actions]

🤖 Claude Code Review

Code Review Analysis

✅ Code Quality

✅ Code follows style guide

• This is a GitHub Actions workflow configuration change, not source code
• YAML structure is clean and follows GitHub Actions conventions

✅ No commented-out code

• No commented code present

✅ Meaningful variable names

• Uses clear, semantic naming: SENZING_GITHUB_PROJECT_RW_TOKEN, SENZING_PROJECT_G2_PYTHON

✅ DRY principle followed

• Single-line version bump, no duplication

✅ No defects identified

• Version bump from v3 to v4 in workflow reference (.github/workflows/add-to-project-g2-python-dependabot.yaml:15)
• Change appears safe assuming the upstream workflow v4 is stable
• No logic errors, edge cases, or security vulnerabilities in this diff

✅ Project memory configuration

• No .claude/CLAUDE.md found in repository (checked earlier context)

⚠️ Testing

⚠️ Cannot verify test requirements

• This is a GitHub Actions workflow version bump - traditional unit/integration tests don't apply
• Recommend manual verification that:
  • The upstream workflow v4 exists at senzing-factory/build-resources
  • The workflow still functions as expected with v4

⚠️ Documentation

❌ CHANGELOG.md not updated

• No CHANGELOG.md modifications visible in this diff
• Version bumps in CI workflows should typically be documented

✅ Readme update not needed

• Workflow version changes don't require README updates

✅ Inline comments appropriate

• Workflow YAML is self-documenting for this simple change

✅ API docs not applicable

• No API changes

✅ Markdown formatting

• No markdown files modified in this diff

✅ Security

✅ No hardcoded credentials

• Properly uses GitHub secrets via ${{ secrets.SENZING_GITHUB_PROJECT_RW_TOKEN }}

✅ No license files or AQAAAD strings

• No .lic files or suspicious base64-encoded content

✅ No sensitive data in logs

• Not applicable to this change

✅ Input validation/error handling

• Delegated to the reusable workflow

---

Summary

This is a low-risk dependency version bump from v3 to v4 for a reusable GitHub Actions workflow.

Required Actions:

1. Update CHANGELOG.md - Document this workflow dependency upgrade

Recommendations:

1. Verify the upstream workflow v4 exists and is compatible
2. Test that Dependabot PRs still get added to the correct project after merge

Overall: Approved with minor documentation fix needed ✅

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Code Review Analysis

Overview

This PR updates a GitHub Actions workflow dependency from v3 to v4 for the add-to-project-dependabot.yaml workflow file.

---

Code Quality

✅ Code follows style guide

• Status: PASS
• Analysis: This is a simple version bump in a GitHub Actions workflow file. The YAML syntax is correct and follows standard GitHub Actions conventions. The style guide primarily applies to application code, not workflow configuration files.

✅ No commented-out code

• Status: PASS
• File: .github/workflows/add-to-project-g2-python-dependabot.yaml
• Analysis: No commented-out code present in this change or the visible context.

✅ Meaningful variable names

• Status: PASS
• Analysis: All variables and configuration keys are clearly named (SENZING_GITHUB_PROJECT_RW_TOKEN, SENZING_PROJECT_G2_PYTHON).

✅ DRY principle followed

• Status: PASS
• Analysis: No duplication introduced by this change.

✅ Identify Defects

• Status: PASS
• Analysis: No bugs, logic errors, or security vulnerabilities introduced. This is a standard dependency version update. The workflow maintains the same structure and parameters, suggesting backward compatibility.

⚠️ Project memory configuration

• Status: N/A
• Analysis: No ./.claude/CLAUDE.md file was found or referenced in this review scope.

---

Testing

⚠️ Unit tests for new functions

• Status: N/A
• Analysis: This is a workflow configuration change, not application code. Testing would occur through the workflow's actual execution in GitHub Actions.

⚠️ Integration tests for new endpoints

• Status: N/A
• Analysis: Not applicable to workflow configuration files.

⚠️ Edge cases covered

• Status: N/A
• Analysis: Not applicable to workflow configuration files.

⚠️ Test coverage > 80%

• Status: N/A
• Analysis: Not applicable to workflow configuration files.

---

Documentation

✅ Readme updated if needed

• Status: PASS
• Analysis: No README updates needed for a workflow version bump.

✅ API docs updated

• Status: N/A
• Analysis: Not applicable to workflow configuration files.

✅ Inline comments for complex logic

• Status: PASS
• Analysis: The workflow is straightforward and self-documenting. No complex logic requiring comments.

❌ CHANGELOG.md updated

• Status: FAIL
• File: CHANGELOG.md (not present in diff)
• Analysis: No CHANGELOG.md update included in this PR. Dependency version bumps should typically be documented in the changelog for traceability, especially for workflow dependencies that may affect CI/CD behavior.

✅ Markdown files follow CommonMark

• Status: PASS
• Analysis: No markdown files modified in this PR.

---

Security

✅ No hardcoded credentials

• Status: PASS
• File: .github/workflows/add-to-project-g2-python-dependabot.yaml:14
• Analysis: Credentials properly use GitHub secrets via ${{ secrets.SENZING_GITHUB_PROJECT_RW_TOKEN }}.

✅ Input validation implemented

• Status: PASS
• Analysis: The workflow uses predefined variables and secrets. Input validation would be handled by the referenced workflow.

✅ Proper error handling

• Status: PASS
• Analysis: Error handling is managed by the reusable workflow being called.

✅ No sensitive data in logs

• Status: PASS
• Analysis: No sensitive data exposed in the configuration.

✅ No license files or AQAAAD strings

• Status: PASS
• Analysis: No .lic files or strings starting with AQAAAD detected.

---

Summary

Overall Assessment: ✅ APPROVED with minor suggestion

Critical Issues: None

Required Changes: None

Recommended Changes:

1. CHANGELOG.md update (.github/workflows/add-to-project-g2-python-dependabot.yaml:15): Consider adding an entry documenting this workflow dependency version bump from v3 to v4 for better traceability.

Positive Aspects:

• Clean, focused change
• Maintains proper secret management
• No security issues introduced
• Follows GitHub Actions best practices

This is a straightforward dependency update that appears safe to merge. The only improvement would be documenting the change in a CHANGELOG for historical tracking.

Automated code review analyzing defects and coding standards