Bump senzing-factory/build-resources/.github/workflows/add-to-project-dependabot.yaml from 3 to 4

[dependabot]

Bumps senzing-factory/build-resources/.github/workflows/add-to-project-dependabot.yaml from 3 to 4.

Release notes

Sourced from senzing-factory/build-resources/.github/workflows/add-to-project-dependabot.yaml's releases.

4.0.0

What's Changed

• #260 make shared workflows generic, misc cleanup by @​kernelsam in senzing-factory/build-resources#261

Full Changelog: senzing-factory/build-resources@v3...4.0.0

3.0.31

What's Changed

• Bump super-linter/super-linter from 8.4.0 to 8.5.0 by @​dependabot[bot] in senzing-factory/build-resources#257
• if the PR's REFRESHED_AT matches main's value, it only passes if that… by @​kernelsam in senzing-factory/build-resources#259

Full Changelog: senzing-factory/build-resources@v3...3.0.31

3.0.30

What's Changed

• Bump super-linter/super-linter from 8.3.1 to 8.3.2 by @​dependabot[bot] in senzing-factory/build-resources#254
• Bump actions/download-artifact from 6 to 7 by @​dependabot[bot] in senzing-factory/build-resources#250
• Bump super-linter/super-linter from 8.3.2 to 8.4.0 by @​dependabot[bot] in senzing-factory/build-resources#255
• Bump actions/upload-artifact from 5 to 6 by @​dependabot[bot] in senzing-factory/build-resources#249
• Fix regex for filtering GitHub workflows by @​kernelsam in senzing-factory/build-resources#256

Full Changelog: senzing-factory/build-resources@v3...3.0.30

3.0.29

What's Changed

• Bump super-linter/super-linter from 8.3.0 to 8.3.1 by @​dependabot[bot] in senzing-factory/build-resources#252
• Remove validation for natural language in workflows by @​kernelsam in senzing-factory/build-resources#253

Full Changelog: senzing-factory/build-resources@v3...3.0.29

3.0.28

What's Changed

• Add Markdown formatting guidelines to PR template by @​kernelsam in senzing-factory/build-resources#244
• Enhance PR review instructions for local and GitHub by @​kernelsam in senzing-factory/build-resources#246
• 247 dockter 1 by @​docktermj in senzing-factory/build-resources#248

New Contributors

• @​docktermj made their first contribution in senzing-factory/build-resources#248

Full Changelog: senzing-factory/build-resources@v3...3.0.28

3.0.27

Full Changelog: senzing-factory/build-resources@v3...3.0.27

3.0.26

Full Changelog: senzing-factory/build-resources@v3...3.0.26

... (truncated)

Changelog

Sourced from senzing-factory/build-resources/.github/workflows/add-to-project-dependabot.yaml's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, markdownlint, and this project adheres to Semantic Versioning.

[Unreleased]

• Thing 5
• Thing 4

[1.0.1] - yyyy-mm-dd

Added to 1.0.1

• Thing 3

Fixed in 1.0.1

• Thing 2

[1.0.0] - yyyy-mm-dd

Added to 1.0.0

• Thing 2
• Thing 1

Commits

• 52eb86b bump tags to v4, slack channel override, missing claude settings (#262)
• 08fb769 #260 make shared workflows generic, misc cleanup (#261)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Resolves #260
Resolves #262
Resolves #261
Resolves senzing-factory/build-resources#261
Resolves senzing-factory/build-resources#257
Resolves senzing-factory/build-resources#259
Resolves senzing-factory/build-resources#254
Resolves senzing-factory/build-resources#250
Resolves senzing-factory/build-resources#255
Resolves senzing-factory/build-resources#249
Resolves senzing-factory/build-resources#256
Resolves senzing-factory/build-resources#252
Resolves senzing-factory/build-resources#253
Resolves senzing-factory/build-resources#244
Resolves senzing-factory/build-resources#246
Resolves senzing-factory/build-resources#248

[github-actions]

🤖 Claude Code Review

Code Review Analysis

Code Quality

✅ Code follows style guide

The change is a simple version bump in a GitHub Actions workflow file. YAML formatting is correct and consistent with the rest of the file.

✅ No commented-out code

No commented-out code present in this change.

✅ Meaningful variable names

Not applicable - this is a version number change, no new variables introduced.

✅ DRY principle followed

Not applicable to this change.

✅ Identify Defects

No defects identified. This is a standard dependency version bump from @v3 to @v4 for a reusable workflow. The change appears safe as it:

• Maintains the same workflow path
• Keeps all existing parameters intact
• Only updates the version tag

Note: Ensure that the senzing-factory/build-resources v4 workflow is compatible with the current configuration and that the SENZING_GITHUB_PROJECT_RW_TOKEN secret permissions remain adequate for v4.

✅ Project memory configuration

No ./.claude/CLAUDE.md file was found in the repository based on the git status, so this criterion is not applicable.

Testing

⚠️ Unit tests for new functions

Not applicable - this is a workflow version bump, not a code change requiring unit tests.

⚠️ Integration tests for new endpoints

Not applicable - no new endpoints added.

⚠️ Edge cases covered

Not applicable - workflow configuration changes don't have traditional edge cases in code.

⚠️ Test coverage > 80%

Not applicable - GitHub Actions workflows are not subject to code coverage metrics.

Recommendation: Consider testing the workflow in a non-production branch or validating that v4 of the referenced workflow has been tested by the senzing-factory team.

Documentation

❌ CHANGELOG.md updated

No changes to CHANGELOG.md detected in this PR. Dependency updates, especially workflow version bumps, should be documented.

Action Required: Add an entry to CHANGELOG.md documenting the workflow version upgrade, for example:

### Changed
- Updated add-to-project-dependabot workflow from v3 to v4 (.github/workflows/add-to-project-senzing-dependabot.yaml:15)

✅ Readme updated if needed

No README update needed - this is an internal workflow change that doesn't affect user-facing functionality or setup instructions.

✅ API docs updated

Not applicable - no API changes.

✅ Inline comments for complex logic

Not applicable - the change is self-explanatory.

✅ Markdown files follow CommonMark

No markdown files were modified in this PR.

Security

✅ No hardcoded credentials

No credentials hardcoded. The workflow correctly uses GitHub secrets.

✅ Input validation implemented

Not applicable - this is a workflow version change.

✅ Proper error handling

Not applicable - error handling is managed by the referenced workflow.

✅ No sensitive data in logs

No changes that would affect logging of sensitive data.

✅ No license files (.lic) or AQAAAD strings

No license files or suspicious strings detected in the diff.

---

Summary

Overall Assessment: ✅ Mostly Approved with Minor Documentation Gap

The PR is a straightforward and safe dependency version update. The only issue is the missing CHANGELOG entry.

Required Actions:

1. Add CHANGELOG.md entry documenting the workflow version bump

Recommended Actions:

1. Verify that v4 of the add-to-project-dependabot workflow is compatible with your current setup
2. Review the v4 release notes from senzing-factory/build-resources to understand what changed between v3 and v4

---

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Code Review Analysis

Review Results

Code Quality

✅ Code follows style guide - The change is a simple version bump in a GitHub Actions workflow file. No code style issues.

✅ No commented-out code - Clean diff with no commented code.

✅ Meaningful variable names - All variables/references are clear and follow GitHub Actions conventions.

✅ DRY principle followed - N/A for this change (single line version update).

✅ No defects identified - This is a straightforward dependency version bump from @v3 to @v4 for a reusable GitHub Actions workflow. No logic errors, edge cases, or security vulnerabilities introduced.

✅ Project memory compliance - Checked ./.claude/CLAUDE.md - this workflow change is consistent with project conventions.

Testing

⚠️ Testing considerations - This change updates a GitHub Actions workflow dependency. While unit/integration tests don't apply to workflow files, the actual testing will occur when:

• Dependabot creates a PR and this workflow triggers
• The workflow should be monitored on first execution with v4

Recommendation: Verify the v4 workflow executes successfully in the first Dependabot PR after this merge.

Documentation

✅ Documentation - No documentation updates needed for a GitHub Actions workflow version bump. The change is self-documenting through the version reference.

⚠️ CHANGELOG.md - .github/workflows/add-to-project-senzing-dependabot.yaml:15 - Consider adding an entry to CHANGELOG.md noting the workflow dependency update from v3 to v4, especially if v4 introduces behavioral changes.

Security

✅ No hardcoded credentials - The workflow properly uses secrets via ${{ secrets.SENZING_GITHUB_PROJECT_RW_TOKEN }}.

✅ No sensitive data - No credentials, API keys, or sensitive information in the change.

✅ No license files - No .lic files or AQAAAD strings detected.

✅ Proper secrets handling - Secrets are correctly referenced through GitHub's secret management.

---

Summary

Overall Assessment: ✅ APPROVED

This is a clean, low-risk change that updates a reusable GitHub Actions workflow dependency from v3 to v4. The change follows best practices for dependency management and maintains proper security posture.

Minor Recommendations:

1. Monitor the first execution of this workflow after merge to ensure v4 compatibility
2. Consider documenting this dependency update in CHANGELOG.md if the v4 version introduces notable changes

No blocking issues identified.

Automated code review analyzing defects and coding standards