chore: Manually fix staging.yml indentation problem caused during dependabot

[bbaarriiss]

Manually fix staging.yml indentation problem caused during dependabot changes

[semgrep-code-wireapp]

Semgrep found 3 github-actions-mutable-action-tag findings:

• .github/workflows/staging.yml
  • L19 - Triage
  • L33 - Triage
  • L41 - Triage

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

[claude]

Review: chore: Manually fix staging.yml indentation

The fix is correct, minimal, and should be merged. A few follow-ups worth considering.

Correctness

The old line put uses: at 6 spaces, i.e. at the same level as the - name: list marker rather than as a key of the mapping that list item contains. That makes .github/workflows/staging.yml invalid YAML, so GitHub could not load the workflow at all — not just skip the Login to Quay.io step. Realigning to 8 spaces restores the name/uses/with mapping and matches every other step in the file. Nothing else in the diff.

Worth checking after merge

Because the workflow file was unparseable, no staging image has been pushed for any commit to main since the Dependabot merge that broke it. After merging, consider firing the workflow_dispatch trigger (already declared) so the current main gets its type=sha tag pushed to Quay, rather than waiting for the next push.

Prevention — the real gap here (test coverage)

Nothing in CI validates workflow files, so a malformed workflow only surfaces as a missing or failed run on main. Two cheap guards:

1. Add a workflow lint step to .github/workflows/pull-request.yml (it already runs ktlint/detekt, so it is the natural home):

         - name: Lint GitHub workflows
           uses: raven-actions/actionlint@v2

   actionlint catches YAML syntax errors, unknown keys, and bad uses: references across .github/workflows/, and it would have failed the Dependabot PR that introduced this. If you would rather not add another action, a plain yamllint .github/workflows covers the syntax half.

2. Annotate the SHA pin with its version, which is plausibly what the Dependabot rewrite tripped over:

         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.x.y

   claude.yml and claude-code-review.yml already follow this convention (anthropics/claude-code-action@be7b93b… # v1.0.183), so this also makes the repo internally consistent and future bumps reviewable at a glance.

Security / consistency note (pre-existing, not introduced here)

staging.yml mixes pinning strategies: docker/login-action is SHA-pinned, while actions/checkout, docker/setup-buildx-action, docker/metadata-action, and docker/build-push-action float on mutable major tags. This job holds QUAY_USERNAME / QUAY_ROBOT_TOKEN and pushes to a registry, so it is the place in the repo where a compromised upstream tag has the most blast radius. Recommend settling on one strategy — ideally SHA-pin all third-party actions here (Dependabot handles SHA pins fine when they carry a version comment).

Code quality / performance

No application code touched, so no runtime, performance, or test implications. Style matches the surrounding file.

Verdict: approve. The lint step and the version comment are suggestions for a follow-up PR, not blockers for this one.