harden workflows: pin every use

[eguzki]

Summary by CodeRabbit

• Chores

  • Improved the reliability and security of automated repository workflows by pinning action versions to specific revisions.
  • Added weekly automated checks for available workflow updates.
  • Applied these updates consistently across code style, testing, plugin, command, and release workflows.

• Tests

  • No changes to test coverage or test behaviour.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 63c6e431-b237-45aa-8cbb-645b8ed6736d

📝 Walkthrough

Walkthrough

Dependabot is configured for weekly GitHub Actions updates. CI, command, plugin, release, and testing workflows replace floating action tags with commit-pinned revisions while preserving existing job logic and inputs.

Changes

GitHub Actions dependency management

Layer / File(s)	Summary
Dependency management and workflow pinning .github/dependabot.yml, .github/workflows/*	Dependabot is configured for weekly GitHub Actions updates, and workflow references are pinned for setup-go, checkout, Codecov, and the release action.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks the workflow trail,
Pins each action, neat and pale.
Dependabot hops once a week,
Keeping fresh revisions in reach.
CI thumps its steady beat.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the PR’s main change: hardening workflows by pinning GitHub Actions references.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch harden-workflows

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/code-style.yaml:
- Line 38: Remove the checkout step from the required-checks aggregate jobs in
.github/workflows/code-style.yaml (lines 38-38), .github/workflows/commands.yaml
(lines 45-45), and .github/workflows/testing.yaml (lines 68-68); leave their
needs-result evaluation unchanged.
- Around line 22-23: Add persist-credentials: false to each repository-only
actions/checkout step in .github/workflows/code-style.yaml (22-23),
.github/workflows/commands.yaml (26-27), .github/workflows/plugins.yaml (35-36),
.github/workflows/release.yaml (23), and both checkout steps in
.github/workflows/testing.yaml (24-25 and 41-42); preserve any checkout
configuration and do not disable credentials where authenticated Git operations
are explicitly required.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 78410ad5-38db-4000-906f-f35786c43df5

📥 Commits

Reviewing files that changed from the base of the PR and between f74f59b and 185e1c0.

📒 Files selected for processing (6)

• .github/dependabot.yml
• .github/workflows/code-style.yaml
• .github/workflows/commands.yaml
• .github/workflows/plugins.yaml
• .github/workflows/release.yaml
• .github/workflows/testing.yaml

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.21%. Comparing base (3988d85) to head (ca9d604).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #124      +/-   ##
==========================================
- Coverage   48.39%   45.21%   -3.19%     
==========================================
  Files          17       18       +1     
  Lines         998      794     -204     
==========================================
- Hits          483      359     -124     
+ Misses        443      363      -80     
  Partials       72       72              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Boomatang]

PR looks good and I would be happy to approve. There is one question that is non blocking but you might want to do it in this PR.

[Boomatang]

I don't know if you want to address it in this PR but there is there different version of the checkout action being used in five different places.

Do you want to address this in this PR?

[eguzki]

good catch. Let me fix that.

[Boomatang]

👍