fix(ci): pin third-party actions to full commit SHAs - #157
Conversation
|
Warning Review limit reachedNext included review available in 39 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (17)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (7)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (17)
🧰 Additional context used🪛 zizmor (1.30.0).github/workflows/language-policy.yml[warning] 23-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) .github/workflows/codeql.yml[warning] 41-42: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) .github/workflows/cflite_pr.yml[warning] 20-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) .github/workflows/proofs.yml[warning] 42-42: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 58-58: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 87-87: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) .github/workflows/publish-container.yml[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) .github/workflows/pages.yml[warning] 23-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 25-29: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🔇 Additional comments (6)
📝 SummarySummary by CodeRabbit
WalkthroughSeven GitHub Actions workflows now reference immutable commit SHAs instead of mutable version tags. Existing workflow logic, permissions, inputs, and version annotations remain unchanged. ChangesWorkflow action pinning
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The workflow pins preserve the existing action versions while meeting the immutable-reference requirement. No actionable risk introduced by this change remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit pins each action tight, Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…0.1.6) `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them.
e109c1e to
46f322c
Compare
…nce to standards@fad242d3 (#163) (#164) Cures the three reds that sit on every push to `main` and every PR, so that a PR can be fully green again. Closes #160. Closes #163. ## What changes | file | change | why | |---|---|---| | `.github/workflows/deno-ci.yml` | deleted | Deno is banned estate-wide (bun is the runtime); the workflow ran on every PR and failed. #160 | | `examples/web-project-deno.json` | deleted | the only Deno artefact; nothing else references it. #160 | | `.github/workflows/governance.yml` | pin `bd0df9ea` → `fad242d35291de1898242d6737ba02b74a59a2f2` (standards main 2026-09-07, post-#742) | the pin tropical-types and nextgen-typing are green on. #163 | | `.github/workflows/actions.lock` | drop the `deno-ci.yml: []` key | the workflow no longer exists | `.github/CONTRIBUTING.md` stays where it is: `check-docs-presence.sh` at the new pin accepts that path and names it the canonical location, so no move was needed. ## How each #163 red is cured (measured, not assumed) - **Allowlist Preflight** — at `fad242d3` the live-policy probe is a separate credentialed advisory job (`actions-policy-live`) that emits `::warning::` and never `exit 1`; `allowlist-preflight` no longer needs `HYPATIA_SCAN_PAT` (declared `required: false`). - **Workflow security linter** — the SPDX predicate now scans the whole leading comment block, so the `# managed by gh actions-lock` line 1 no longer hides the `SPDX-License-Identifier` on line 2. Ran the exact predicate over all 16 workflows on this branch: 0 failures. Also ran the three new steps' scripts locally (`check-workflows-parse.sh`, `check-workflow-duplicate-keys.sh` at `fad242d3`; `check-action-pins-resolve.sh` from main): all 16 parse, 16 clean, 3/3 pins resolve. - **Code quality + docs** — `check-docs-presence.sh` passes with CONTRIBUTING under `.github/` (`✅ Core documentation present`). Other gates at the new pin, run locally against this branch: - `check-actions-lock-gate.sh` with `update-actions-lock.sh --verify-local` (the `actions-lock-verify` job): `valid: true`, transitive coverage verified. One pre-existing advisory `sha-as-ref` note on `push-email-notify.yml`'s bare-SHA ref, not a failure. - exemption ratchet vs `origin/main`: unchanged (`.hypatia-ignore` 9, `root-allow.txt` 1), OK. Debt ratchet: no Debtfile, nothing to ratchet. - `check-ts-allowlist.sh`, `check-language-policy.sh` (the two new language-policy steps): both pass. Tracked `*.v` files are Coq; the V-lang rule keys on `v.mod`/`vpkg.json` only. **Lock-free bump:** every step-level action inside `governance-reusable.yml@fad242d3` (checkout `3d3c42e5`, cache `55cc8345`, editorconfig `840e866d`, setup-beam `54075bcc`) is already in `actions.lock` at that SHA. Standards HEAD would bump editorconfig to `51f63319` and force a lock regeneration; deliberately not taken. ## Note on the `Rust CI` check `rust-ci-reusable.yml@bd0df9ea`'s detect job checks out `refs/pull/N/merge`. When a PR is merged within seconds of opening, the merge ref is gone by the time the queued job starts and the check fails on `Checkout repository` (that is what happened to #158 and #159; #157, held open, passed). Holding this PR open until every check is green avoids the race; a pin bump to a reusable with the `github.sha` cure is a separate follow-up. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01QYY8Gp4v4x2J7iSNn1vZ57 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
1 participant
fix(ci): pin third-party actions to full commit SHAs
The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup —
startup_failure, no jobs, "this workflow graph cannot be shown" — so these workflowscould not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g.
actions/checkout@<sha> # v4.dtolnay/rust-toolchaintakes its toolchain from the ref itself, so those steps also gained anexplicit
with: toolchain:input; without it, a SHA ref would silently lose the channel.No behaviour is intended to change beyond the pins.