Repository navigation
fix(ci): reconcile the workflows with actions.lock (gh-actions-lock) - #44
Conversation
…0.1.6) `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (10)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (8)
🔇 Additional comments (10)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request adds ChangesWorkflow action reference reconciliation
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description explains the main change and its purpose, but it omits the required Summary, Validation, Risk, and Related headings. It also does not record validation results, documentation status, risk, or related issues. Resolution Add the required template sections. Include validation results for ./scripts/validate-docs.sh, docs/changelog updates, and factual claims. Describe operational, security, and governance risk. Add related issue or discussion links, or state that none apply. Keep the existing explanation under Summary, with the required heading present.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks each workflow line, Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
2 participants
fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6)
actions.lockis authoritative: the workflows carry readable refs and the lock records thecommit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable —
startup_failure, "Invalid lockfile".Regenerated with the official extension (
github/gh-actions-lock). The hand-pinned SHA refs arereverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.