fix(ci): reconcile the workflows with actions.lock (gh-actions-lock) - #87
Conversation
…0.1.6) `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (17)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (24)
🧰 Additional context used🪛 GitHub Check: SonarCloud Code Analysis.github/workflows/casket-pages.yml[failure] 36-36: Use full commit SHA hash for this dependency. .github/workflows/dependabot-automerge.yml[failure] 61-61: Use full commit SHA hash for this dependency. .github/workflows/release.yml[failure] 143-143: Use full commit SHA hash for this dependency. .github/workflows/static-analysis-gate.yml[failure] 160-160: Use full commit SHA hash for this dependency. .github/workflows/instant-sync.yml[failure] 23-23: Use full commit SHA hash for this dependency. 🔇 Additional comments (17)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request updates 17 GitHub Actions workflows. It adds ChangesGitHub Actions workflow maintenance
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~12 minutes Change: Bug fix 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description explains the purpose and main workflow changes. However, it omits the required Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections, including test and checklist results.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each workflow line Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6)
actions.lockis authoritative: the workflows carry readable refs and the lock records thecommit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable —
startup_failure, "Invalid lockfile".Regenerated with the official extension (
github/gh-actions-lock). The hand-pinned SHA refs arereverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.