fix(ci): freeze reviewed action pins from Dependabot version updates

action_consumer_manifests.json pins each release-consumed action to an exact SHA plus the upstream action.yml sha256, and release_promotion_policy_test.py requires every workflow step to match. Dependabot's github-actions group bumps those SHAs, so every group proposal fails the manifest contract and cannot be repaired offline. Ignore the eight governed actions for version updates and guard the policy against the manifest so pin refreshes stay explicit reviewed work. This resolves the recurring failing actions-minor-patch proposal (#2139).

Change-source: pulse-maintainer

.github/dependabot.yml

@@ -23,6 +23,21 @@ updates:
         update-types:
           - "minor"
           - "patch"
+    # scripts/release_control/action_consumer_manifests.json pins each
+    # release-consumed action to an exact SHA plus the upstream action.yml
+    # sha256, and release_promotion_policy_test.py requires every workflow step
+    # to match that manifest. Refreshing a pin needs the upstream action bytes
+    # through the reviewed pin-refresh route, so keep these actions as explicit
+    # work rather than opening proposals the manifest contract cannot accept.
+    ignore:
+      - dependency-name: "actions/attest"
+      - dependency-name: "azure/setup-helm"
+      - dependency-name: "docker/build-push-action"
+      - dependency-name: "docker/login-action"
+      - dependency-name: "docker/setup-buildx-action"
+      - dependency-name: "docker/setup-qemu-action"
+      - dependency-name: "signpath/github-action-submit-signing-request"
+      - dependency-name: "tailscale/github-action"
 
   - package-ecosystem: "gomod"
     directories:

scripts/tests/test_dependabot_config.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 """Guard the low-noise dependency update policy and its covered manifests."""
 
+import json
 from pathlib import Path
 import unittest
 
@@ -10,6 +11,7 @@ import yaml
 ROOT = Path(__file__).resolve().parents[2]
 CONFIG = ROOT / ".github" / "dependabot.yml"
 SECURITY_SCAN = ROOT / ".github" / "workflows" / "security-scan.yml"
+ACTION_MANIFESTS = ROOT / "scripts" / "release_control" / "action_consumer_manifests.json"
 
 
 def manifest_directories(filename: str) -> list[str]:
@@ -159,6 +161,20 @@ class DependabotConfigTest(unittest.TestCase):
             {"version-update:semver-major"},
         )
 
+    def test_github_actions_updates_preserve_reviewed_action_pins(self) -> None:
+        # action_consumer_manifests.json pins each release-consumed action to an
+        # exact SHA plus the upstream action.yml sha256, and
+        # release_promotion_policy_test.py requires every workflow step to match
+        # it. Refreshing a pin needs the upstream bytes through the reviewed
+        # pin-refresh route, so Dependabot must not propose version updates the
+        # manifest contract would reject.
+        manifests = json.loads(ACTION_MANIFESTS.read_text(encoding="utf-8"))
+        ignored = {
+            item["dependency-name"]
+            for item in self.updates["github-actions"]["ignore"]
+        }
+        self.assertEqual(ignored, set(manifests))
+
     def test_weekly_scan_covers_the_same_lockfiles(self) -> None:
         workflow = yaml.safe_load(SECURITY_SCAN.read_text(encoding="utf-8"))
         jobs = workflow["jobs"]