From 810979b2b5baebb1de67d0862c6a4429d4b11e1d Mon Sep 17 00:00:00 2001 From: Harish Seshadri Date: Mon, 3 Aug 2026 06:50:52 -0700 Subject: [PATCH] fix(ci): pin comments name the exact version, not the floating major MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit main went red at ca31ca0 with no change in this repo. Upstream shipped pnpm/action-setup v6.0.10 at 12:06 UTC today and moved the floating `v6` tag onto it. Our SHA 0ebf4713 is exactly v6.0.9, but the comment said `# v6`, and zizmor's ref-version-mismatch resolves that comment against upstream — so the label became a lie the moment someone else cut a release. Five pins carried the same trap. codecov was already mismatched and simply had not been reported yet: codecov/codecov-action # v7 -> # v7.0.0 (v7 had already moved to a99c28d3) gitleaks/gitleaks-action # v3 -> # v3.0.0 actions/cache (x2) # v6 -> # v6.1.0 pnpm/action-setup # v6 -> # v6.0.9 (today's failure) No SHA changes. Every pin still resolves to the identical commit; only the label now tells the truth about which release that commit is. This is the opposite of weakening the gate — a floating-major comment on an immutable SHA pin is unfalsifiable until upstream moves the tag, and then it fails for a reason that has nothing to do with this repo. Deliberately NOT bumping to pnpm/action-setup v6.0.10: it is three hours old and the portfolio's minimum-release-age discipline applies. Dependabot will propose it once it has aged. Claim touched: every third-party action is SHA-pinned with an accurate version label. Watched red run: CI run 30819268560 on main, exit 13, one medium ref-version-mismatch. Locally reproduced by reverting the pnpm comment to `# v6` — asserted the mutation applied, then `uvx zizmor@1.26.1 .` exit 13; restored, exit 0, "No findings to report." Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015o7tjWLFZvzRv4KyNfDukx --- .github/actions/restore-model-cache/action.yml | 2 +- .github/actions/setup-playwright/action.yml | 2 +- .github/actions/setup-pnpm/action.yml | 2 +- .github/workflows/python-gate.yml | 2 +- .github/workflows/secret-scan.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/actions/restore-model-cache/action.yml b/.github/actions/restore-model-cache/action.yml index ae5c122..0381625 100644 --- a/.github/actions/restore-model-cache/action.yml +++ b/.github/actions/restore-model-cache/action.yml @@ -49,7 +49,7 @@ runs: steps: - name: Restore model-weights cache id: cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ${{ inputs.cache-path }} key: ${{ inputs.cache-key }} diff --git a/.github/actions/setup-playwright/action.yml b/.github/actions/setup-playwright/action.yml index 9fe63e1..1d0455a 100644 --- a/.github/actions/setup-playwright/action.yml +++ b/.github/actions/setup-playwright/action.yml @@ -40,7 +40,7 @@ runs: steps: - name: Restore Playwright browser cache id: cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/ms-playwright key: ${{ inputs.cache-key }} diff --git a/.github/actions/setup-pnpm/action.yml b/.github/actions/setup-pnpm/action.yml index a69368d..bac1436 100644 --- a/.github/actions/setup-pnpm/action.yml +++ b/.github/actions/setup-pnpm/action.yml @@ -62,7 +62,7 @@ inputs: runs: using: composite steps: - - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 + - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 with: package_json_file: ${{ inputs.package-json-file }} - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/.github/workflows/python-gate.yml b/.github/workflows/python-gate.yml index 5417160..4e1b10b 100644 --- a/.github/workflows/python-gate.yml +++ b/.github/workflows/python-gate.yml @@ -100,7 +100,7 @@ jobs: - name: Upload coverage to Codecov if: ${{ inputs.upload-coverage }} - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: files: ${{ inputs.working-directory }}/${{ inputs.coverage-file }} token: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index df9e2cb..ab8db4c 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -45,6 +45,6 @@ jobs: with: persist-credentials: false fetch-depth: 0 # full history — gitleaks scans every commit, not just HEAD - - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3 + - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}