From 5386b401777c30a01c137f86f70d0ed75c4bcb35 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 23:03:01 +0000 Subject: [PATCH] fix(ci): pin third-party actions to full commit SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows could not run at all. This resolves each ref to the commit it currently points at and records the ref in a trailing comment, e.g. `actions/checkout@ # v4`. `dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel. No behaviour is intended to change beyond the pins. --- .github/workflows/fragment-conformance.yml | 6 +++--- .github/workflows/rhodibot.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/fragment-conformance.yml b/.github/workflows/fragment-conformance.yml index 3ddbe7d..c79f819 100644 --- a/.github/workflows/fragment-conformance.yml +++ b/.github/workflows/fragment-conformance.yml @@ -18,11 +18,11 @@ jobs: timeout-minutes: 15 steps: - name: Checkout specification - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Checkout pinned QuandleDB implementation - uses: actions/checkout@v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: repository: hyperpolymath/quandledb ref: f1d0010e4e614fcb2c8428e555b9cdbb279d4da7 @@ -31,7 +31,7 @@ jobs: - name: Record implementation revision run: git -C deps/quandledb rev-parse HEAD - name: Install Julia - uses: julia-actions/setup-julia@v2.7.0 + uses: julia-actions/setup-julia@4c0cb0fce8556fdb04a90347310e5db8b1f98fb9 # v2.7.0 with: version: '1.12.6' - name: Check fragment syntax, execution and explicit refusal diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index 29dc13e..255ddea 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -34,7 +34,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 - name: Rhodibot — detect drift (no mutations)