fix(ci): pin comments name the exact version, not the floating major - #13
Merged
Conversation
main went red at ca31ca0 with no change in this repo. Upstream shipped pnpm/action-setup v6.0.10 at 12:06 UTC today and moved the floating `v6` tag onto it. Our SHA 0ebf4713 is exactly v6.0.9, but the comment said `# v6`, and zizmor's ref-version-mismatch resolves that comment against upstream — so the label became a lie the moment someone else cut a release. Five pins carried the same trap. codecov was already mismatched and simply had not been reported yet: codecov/codecov-action # v7 -> # v7.0.0 (v7 had already moved to a99c28d3) gitleaks/gitleaks-action # v3 -> # v3.0.0 actions/cache (x2) # v6 -> # v6.1.0 pnpm/action-setup # v6 -> # v6.0.9 (today's failure) No SHA changes. Every pin still resolves to the identical commit; only the label now tells the truth about which release that commit is. This is the opposite of weakening the gate — a floating-major comment on an immutable SHA pin is unfalsifiable until upstream moves the tag, and then it fails for a reason that has nothing to do with this repo. Deliberately NOT bumping to pnpm/action-setup v6.0.10: it is three hours old and the portfolio's minimum-release-age discipline applies. Dependabot will propose it once it has aged. Claim touched: every third-party action is SHA-pinned with an accurate version label. Watched red run: CI run 30819268560 on main, exit 13, one medium ref-version-mismatch. Locally reproduced by reverting the pnpm comment to `# v6` — asserted the mutation applied, then `uvx zizmor@1.26.1 .` exit 13; restored, exit 0, "No findings to report." Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015o7tjWLFZvzRv4KyNfDukx
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
hseshadr
added a commit
that referenced
this pull request
Aug 3, 2026
…#14) #12 bumped astral-sh/setup-uv 8.3.2 -> 9.0.0 but touched only .github/workflows/ci.yml — this repo's own self-test. The file consumers actually execute, .github/actions/setup-python-uv/action.yml, stayed on v8.3.2, so the bump reached nobody downstream. The split was already visible in the field: edge-proc and edgeproc-core run v9.0.0 directly in their own ci.yml while calling this composite on their publish path — v9 on test, v8.3.2 on publish, same repo, same PR. c771a70e6277c0a99b617c7a806ffedaca235ff9 is v9.0.0, confirmed against `gh api repos/astral-sh/setup-uv/tags` (v8.3.2 there is the outgoing 11f9893b), and is the same SHA #12 and both consumers already run. The version comment names v9.0.0 exactly. #13 just removed five floating-major comments for this reason: zizmor's ref-version-mismatch resolves the comment against upstream, so `# v9` turns main red the moment astral-sh cuts a patch. No floating major tag exists upstream anyway — `v9` and `v8` both 404. Claim touched: "consumers of this composite run a pinned, immutable, auditable setup-uv." It was true about immutability and false about which version — the audited pin and the executed pin were different files. Evidence: - GH_TOKEN=... uvx zizmor@1.26.1 . -> exit 0, "No findings to report" - actionlint -> clean; shellcheck -x + bash -n -> clean - tests/security-policy.sh -> exit 0 - tests/lint-examples.sh -> exit 0, 173 refs resolved, 0 MISSING Still on the old SHA after this change: nothing executable. README.md:422 and CHANGELOG.md:273,401 mention v8.3.2 as prose; README.md:197 shows v8.1.0 in a sample. Reported, not edited — no gate reads them. Claude-Session: https://claude.ai/code/session_015o7tjWLFZvzRv4KyNfDukx Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mainwent red atca31ca0and nothing in this repo changed. Upstream shippedpnpm/action-setupv6.0.10 at 12:06 UTC today and moved the floatingv6tag onto it. Our SHA0ebf4713is exactly v6.0.9, but the comment said# v6— and zizmor'sref-version-mismatchresolves that comment against upstream. The label became false the moment somebody else cut a release.This is not the pnpm bump PR. It fixes the class.
Five pins carried the same trap
codecov/codecov-action# v7# v7.0.0a99c28d3f0da— already mismatched, just not reported yetgitleaks/gitleaks-action# v3# v3.0.0e0c47f4f8be3(still matches, for now)actions/cache×2# v6# v6.1.055cc8345863c(still matches, for now)pnpm/action-setup# v6# v6.0.9f520eceda224— today's failureNo SHA changed. Every pin resolves to the identical commit. Only the label now says which release that commit actually is.
A floating-major comment on an immutable SHA pin is unfalsifiable — it looks right indefinitely, then goes red for a reason that has nothing to do with this repo. Two of the five were already wrong before today.
Deliberately not bumping
pnpm/action-setup@v6.0.10is three hours old. The minimum-release-age discipline applies; a dependency failing an age gate is the gate working. Dependabot will propose it once it has aged.Claim touched
Every third-party action is SHA-pinned with an accurate version label.
Proof the guard can fail
Verdicts are exit codes, and the mutation was asserted to have applied to the file before its run was trusted.
mainin CIref-version-mismatchatsetup-pnpm/action.yml:65uvx zizmor@1.26.1 .No findings to report. Good job! (1 ignored, 10 suppressed)# v6uvx zizmor@1.26.1 .Follow-up, not in this PR
astral-sh/setup-uvis split-brain:ci.ymlis on v9.0.0 after #12, while.github/actions/setup-python-uv/action.yml:54— the composite consumers actually execute — is still v8.3.2. #12 never touched it. Separate PR.🤖 Generated with Claude Code
https://claude.ai/code/session_015o7tjWLFZvzRv4KyNfDukx