fix(ci): reconcile the workflows with actions.lock (gh-actions-lock) - #89
Conversation
…0.1.6) `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (21)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (29)
🧰 Additional context used🪛 GitHub Check: SonarCloud Code Analysis.github/workflows/release.yml[failure] 129-129: Use full commit SHA hash for this dependency. .github/workflows/e2e.yml[failure] 49-49: Use full commit SHA hash for this dependency. [failure] 83-83: Use full commit SHA hash for this dependency. .github/workflows/dependabot-automerge.yml[failure] 55-55: Use full commit SHA hash for this dependency. .github/workflows/instant-sync.yml[failure] 18-18: Use full commit SHA hash for this dependency. .github/workflows/fragment-conformance.yml[failure] 34-34: Use full commit SHA hash for this dependency. .github/workflows/static-analysis-gate.yml[failure] 145-145: Use full commit SHA hash for this dependency. 🔇 Additional comments (21)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request updates GitHub Actions workflow metadata and action references. It adds ChangesWorkflow maintenance
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~15 minutes Change: Bug fix 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each workflow line Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
2 participants
fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6)
actions.lockis authoritative: the workflows carry readable refs and the lock records thecommit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable —
startup_failure, "Invalid lockfile".Regenerated with the official extension (
github/gh-actions-lock). The hand-pinned SHA refs arereverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.