fix(ci): pin third-party actions to full commit SHAs - #58
Conversation
|
Warning Review limit reachedNext included review available in 38 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (10)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (15)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (13)
🧰 Additional context used📓 Path-based instructions (1)Or the `.github/workflows/` section in GitInit block📄 CodeRabbit inference engine (rescript-templater/CLAUDE.md) Files:
🪛 zizmor (1.30.0).github/workflows/boj-build.yml[warning] 14-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) .github/workflows/casket-pages.yml[warning] 21-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 23-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) .github/workflows/secret-scanner.yml[warning] 22-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🔇 Additional comments (13)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request replaces mutable GitHub Actions tags and branches with immutable commit SHAs across repository and nested project workflows. Existing workflow inputs and behaviour remain unchanged. ChangesWorkflow action pinning
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Other Suggested reviewers: Merge Risk: ⚪ Minimal · up to The action pins preserve the selected releases and existing workflow behavior, with no concrete PR-introduced risk remaining. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each workflow line Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…0.1.6) `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them.
b4de3eb to
c363125
Compare
|
1 participant
fix(ci): pin third-party actions to full commit SHAs
The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup —
startup_failure, no jobs, "this workflow graph cannot be shown" — so these workflowscould not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g.
actions/checkout@<sha> # v4.dtolnay/rust-toolchaintakes its toolchain from the ref itself, so those steps also gained anexplicit
with: toolchain:input; without it, a SHA ref would silently lose the channel.No behaviour is intended to change beyond the pins.