Skip to content

ci(lock): lock taiki-e/install-action@v2.87.26 (fixes lint red on main since #412) - #419

Merged
hyperpolymath merged 1 commit into
mainfrom
arena/8040463d-echidna
Oct 9, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
arena/8040463d-echidna

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Fixes the lockfile step that has been red on main since #412.

PR #412 (dependabot, actions group) moved mvp-smoke.yml and s4-loop.yml from taiki-e/install-action@v2.87.22 to v2.87.26, but did not update actions.lock. The Verify immutable action lockfile step then fails, which makes lint-workflows / Workflow Security Linter red on main.

The change is one lock entry: v2.87.26 at the upstream tag commit f7e5d7c, with the same owner_id and repo_id. No workflow references v2.87.22 any more, so that entry is replaced.

Verified:

  • No workflow file references an unlocked action ref (checked by parsing every uses:).
  • The authoritative gh-actions-lock --rescan --no-fix could not be run from the agent sandbox (its release download is outside the allow-list). CI is the verifier here.

Note: this PR was prepared after #417 had already merged, so it is based on current main.

…s4-loop

PR #412 (dependabot, actions group) bumped the workflow refs from v2.87.22 to
v2.87.26 but did not update actions.lock. The lock check ('Verify immutable
action lockfile') then fails on main, which is the Workflow Security Linter
red since #412. The entry is the v2.87.26 tag commit (f7e5d7c), with the same
owner_id and repo_id as before. No workflow references v2.87.22 any more, so
that entry is replaced rather than kept.

Verified: no workflow file references the unlocked ref; the change is one
entry replaced in the lock. The authoritative gh-actions-lock check could not be
run from the agent sandbox (its release download is outside the allow-list), so
CI is the verifier.

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
@coderabbitai

coderabbitai Bot commented Oct 9, 2026

Copy link
Copy Markdown

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • .github/workflows/actions.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 34e6b113-c226-4291-99b0-e0e12ba01e7f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath marked this pull request as ready for review October 9, 2026 19:13
@hyperpolymath
hyperpolymath merged commit d8ca3dc into main Oct 9, 2026
61 of 66 checks passed
@hyperpolymath
hyperpolymath deleted the arena/8040463d-echidna branch October 9, 2026 19:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant