[greenc-FNAL]

Summary

• Identify PR merges into this repository's main by matching the pushed SHA to GitHub's merged-PR records instead of relying on the committer name, including rebase merges.
• Alert for direct or forced branch updates, including bot pushes and force pushes that restore an old PR merge.
• Grant only PR read permission, safely construct the Slack JSON payload, and fail on API, configuration, or delivery errors.
• Preserve the action repositories' always-enabled behavior.

Dependencies

This PR changes only .github/workflows/guardrail-audit-alert.yaml and is based directly on upstream/main, independently of the actionlint PR. The PRs can merge in either order. The workflow matches Framework-R-D/action-generate-build-matrix#56 byte-for-byte.

Validation

• Pre-commit checks passed for the changed workflow before pushing.
• The propagated workflows passed pinned actionlint 1.7.12, standalone ShellCheck, Bash syntax and whitespace validation, and 270 behavioral regression cases across the action repositories.
• git diff --check passed and the complete staged diff was inspected.
• No live Slack webhook delivery was exercised.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 55 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f8ff8aff-d920-40f5-9f5d-6fae4c04af44

Commits

Reviewing files that changed from the base of the PR and between 9157776 and 09e6714.

Files selected for processing: 1

• .github/workflows/guardrail-audit-alert.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the guardrail workflow update.

No open issues 🎉

What changed in this PR

Updates the repository’s guardrail workflow to identify merges into main using merged PR records rather than committer names, including support for rebase merges.

Changes:

• Matches pushed SHAs against merged PRs targeting this repository’s main.
• Treats forced updates as alert-worthy and removes the Dependabot exemption.
• Adds PR read permission and explicit failure handling while preserving safe Slack JSON construction.

File	Description
.github/​workflows/​guardrail-audit-alert.yaml	Replaces committer-based detection with PR-record checks and strengthens Slack delivery error handling.

_{Review effort: Balanced}