Repository navigation
fix(ci): restore reachable standards workflow pins - #82
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🔇 Additional comments (3)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request updates the pinned commit for the reusable mirror and Scorecard workflows. No workflow structure, permissions, or job behaviour changed. ChangesWorkflow pin updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: 🟡 Moderate · up to The mirror and Scorecard workflows now use a new pinned standards commit, but the selected pin differs from the stated remediation target. If it is not reachable or lacks the intended reusable workflows, CI and security reporting workflows may remain unable to start. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description explains the purpose and incident context, but it does not follow the required template. It omits the Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections. It also references SHA 092dedada188f56c5915f74a5fd40aac093742c3, while the file summary reports SHA fad242d35291de1898242d6737ba02b74a59a2f2. Resolution Rewrite the description using all required template sections. List the workflow changes, record testing results, complete the applicable checklist items, and state whether screenshots or terminal output apply. Resolve the discrepancy between the SHA in the description and the SHA reported in the file changes before merging.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each workflow pin, Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
…s main HEAD The previous target 092dedad is 4 commits behind standards main and would reintroduce bugs fixed there; main had meanwhile moved scorecard to 571cc734 (39 behind). Both callers now pin fad242d35291 (standards main HEAD, 2026-09-07). mirror.yml already grants actions: read, which mirror-reusable at HEAD requests; scorecard-reusable at HEAD requests no new permission.
1 participant
Replace the unreachable standards reusable-workflow commit 7fdc2705df74b4e352d2a1cde3e87a5923fdf329 with reachable standards main commit 092dedada188f56c5915f74a5fd40aac093742c3. The old SHA is an intermediate commit from squash-merged standards PR #596: it exists, but GitHub rejects it for cross-repository reusable workflows before creating jobs. This restores Hypatia/SARIF and the other affected workflows without weakening SHA pinning or branch protection. Estate incident: 251 active workflow files across 70 repositories in hyperpolymath and metadatastician.