Skip to content

fix(ci): pin third-party actions to full commit SHAs - #79

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/sha-pin-actions
Sep 19, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
fix/sha-pin-actions

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

fix(ci): pin third-party actions to full commit SHAs

The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup — startup_failure, no jobs, "this workflow graph cannot be shown" — so these workflows
could not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g. actions/checkout@<sha> # v4.

dtolnay/rust-toolchain takes its toolchain from the ref itself, so those steps also gained an
explicit with: toolchain: input; without it, a SHA ref would silently lose the channel.

No behaviour is intended to change beyond the pins.

The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows
could not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g. `actions/checkout@<sha> # v4`.

`dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an
explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel.

No behaviour is intended to change beyond the pins.
@coderabbitai

coderabbitai Bot commented Sep 19, 2026

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 47ac1e76-317e-4630-abe4-9e5494f11eaf

📥 Commits

Reviewing files that changed from the base of the PR and between 81378cc and 9435a23.

📒 Files selected for processing (1)
  • .github/workflows/rhodibot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (4)
  • GitHub Check: Deposit findings for gitbot-fleet
  • GitHub Check: governance / Check Workflow Staleness
  • GitHub Check: scan / Hypatia Neurosymbolic Analysis
  • GitHub Check: analyze (actions, none)
⚠️ CI failures not shown inline (10)

GitHub Actions: Rust CI / 2_rust-ci _ Cargo check + clippy + fmt.txt: fix(ci): pin third-party actions to full commit SHAs

Conclusion: failure

View job details

##[group]Run : parse toolchain version
 �[36;1m: parse toolchain version�[0m
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: Rust CI / rust-ci _ Cargo check + clippy + fmt: fix(ci): pin third-party actions to full commit SHAs

Conclusion: failure

View job details

##[group]Run : parse toolchain version
 �[36;1m: parse toolchain version�[0m
 �[36;1mif [[ -z $toolchain ]]; then�[0m
 �[36;1m  # GitHub does not enforce `required: true` inputs itself. https://github.com/actions/runner/issues/1070�[0m
 �[36;1m  echo "'toolchain' is a required input" >&2�[0m
 �[36;1m  exit 1�[0m
 �[36;1melif [[ $toolchain =~ ^stable' '[0-9]+' '(year|month|week|day)s?' 'ago$ ]]; then�[0m
 �[36;1m  if [[ Linux == macOS ]]; then�[0m
 �[36;1m    echo "toolchain=1.$((($(date -v-$(sed 's/stable \([0-9]*\) \(.\).*/\1\2/' <<< $toolchain) +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  else�[0m
 �[36;1m    echo "toolchain=1.$((($(date --date "${toolchain#stable }" +%s)/60/60/24-16569)/7/6))" >> $GITHUB_OUTPUT�[0m
 �[36;1m  fi�[0m
 �[36;1melif [[ $toolchain =~ ^stable' 'minus' '[0-9]+' 'releases?$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((($(date +%s)/60/60/24-16569)/7/6-${toolchain//[^0-9]/}))" >> $GITHUB_OUTPUT�[0m
 �[36;1melif [[ $toolchain =~ ^1\.[0-9]+$ ]]; then�[0m
 �[36;1m  echo "toolchain=1.$((i=${toolchain#1.}, c=($(date +%s)/60/60/24-16569)/7/6, i+9*i*(10*i<=c)+90*i*(100*i<=c)))" >> $GITHUB_OUTPUT�[0m
 �[36;1melse�[0m
 �[36;1m  echo "toolchain=$toolchain" >> $GITHUB_OUTPUT�[0m
 �[36;1mfi�[0m
 shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
 env:
   toolchain:
 ##[endgroup]
 'toolchain' is a required input
 ##[error]Process completed with exit code 1.

GitHub Actions: Dogfood Gate / 2_Validate K9 contracts.txt: fix(ci): pin third-party actions to full commit SHAs

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 7 K9 file(s)
   Validating: ./.machine_readable/contractiles/k9/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-hunt.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-kennel.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-yard.k9.ncl
   Validating: ./container/deploy.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'

GitHub Actions: Dogfood Gate / Validate K9 contracts: fix(ci): pin third-party actions to full commit SHAs

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 7 K9 file(s)
   Validating: ./.machine_readable/contractiles/k9/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-hunt.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-kennel.k9.ncl
   Validating: ./.machine_readable/contractiles/k9/template-yard.k9.ncl
   Validating: ./container/deploy.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'

GitHub Actions: Dogfood Gate / 3_Validate eclexiaiser manifest.txt: fix(ci): pin third-party actions to full commit SHAs

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using Python 3.11+ tomllib�[0m
 �[36;1mpython3 -c "�[0m
 �[36;1mimport tomllib, sys�[0m
 �[36;1mwith open('eclexiaiser.toml', 'rb') as f:�[0m
 �[36;1m    data = tomllib.load(f)�[0m
 �[36;1mproject = data.get('project', {})�[0m
 �[36;1mif not project.get('name', '').strip():�[0m
 �[36;1m    print('ERROR: project.name is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfunctions = data.get('functions', [])�[0m
 �[36;1mif not functions:�[0m
 �[36;1m    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfor fn in functions:�[0m
 �[36;1m    if not fn.get('name', '').strip():�[0m
 �[36;1m        print('ERROR: function name cannot be empty', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1m    if not fn.get('source', '').strip():�[0m
 �[36;1m        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1mprint(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')�[0m
 �[36;1m" || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Dogfood Gate / Validate eclexiaiser manifest: fix(ci): pin third-party actions to full commit SHAs

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using Python 3.11+ tomllib�[0m
 �[36;1mpython3 -c "�[0m
 �[36;1mimport tomllib, sys�[0m
 �[36;1mwith open('eclexiaiser.toml', 'rb') as f:�[0m
 �[36;1m    data = tomllib.load(f)�[0m
 �[36;1mproject = data.get('project', {})�[0m
 �[36;1mif not project.get('name', '').strip():�[0m
 �[36;1m    print('ERROR: project.name is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfunctions = data.get('functions', [])�[0m
 �[36;1mif not functions:�[0m
 �[36;1m    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfor fn in functions:�[0m
 �[36;1m    if not fn.get('name', '').strip():�[0m
 �[36;1m        print('ERROR: function name cannot be empty', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1m    if not fn.get('source', '').strip():�[0m
 �[36;1m        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1mprint(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')�[0m
 �[36;1m" || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Dogfood Gate / 4_Groove manifest check.txt: fix(ci): pin third-party actions to full commit SHAs

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / Groove manifest check: fix(ci): pin third-party actions to full commit SHAs

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / 5_Validate A2ML manifests.txt: fix(ci): pin third-party actions to full commit SHAs

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 118 .a2ml file(s)
   Validating: ./.github/0.1-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/0.1-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/ENSAID_CONFIG.a2ml
   Validating: ./.machine_readable/agent_instructions/coverage.a2ml
   Validating: ./.machine_readable/agent_instructions/debt.a2ml
   Validating: ./.machine_readable/agent_instructions/methodology.a2ml
   Validating: ./.machine_readable/ai/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/ai/AI.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/anchors/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/anchors/ANCHOR.a2ml
   Validating: ./.machine_readable/configs/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/contractiles/dust/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/intend/Intendfile.a2ml
   Validating: ./.machine_readable/contractiles/lust/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/must/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/trust/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./.machine_readable/policies/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/policies/MAINTENANCE-AXES.a2ml
   Validating: ./.machine_readable/policies/MAINTE...

GitHub Actions: Dogfood Gate / Validate A2ML manifests: fix(ci): pin third-party actions to full commit SHAs

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 118 .a2ml file(s)
   Validating: ./.github/0.1-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/0.1-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/ENSAID_CONFIG.a2ml
   Validating: ./.machine_readable/agent_instructions/coverage.a2ml
   Validating: ./.machine_readable/agent_instructions/debt.a2ml
   Validating: ./.machine_readable/agent_instructions/methodology.a2ml
   Validating: ./.machine_readable/ai/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/ai/AI.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/anchors/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/anchors/ANCHOR.a2ml
   Validating: ./.machine_readable/configs/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/contractiles/dust/Dustfile.a2ml
   Validating: ./.machine_readable/contractiles/intend/Intendfile.a2ml
   Validating: ./.machine_readable/contractiles/lust/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/must/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/trust/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./.machine_readable/policies/0.2-AI-MANIFEST.a2ml
   Validating: ./.machine_readable/policies/MAINTENANCE-AXES.a2ml
   Validating: ./.machine_readable/policies/MAINTE...
🔇 Additional comments (1)
.github/workflows/rhodibot.yml (1)

37-37: 🔒 Security & Privacy | 🛡️ Analyzed with Security Review

The pinned SHA matches actions/checkout v7.0.1. No change is required.

Likely an incorrect or invalid review comment.


📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated internal automation configuration to use a fixed, verified version reference.
    • This improves the consistency and security of automated project workflows.
    • No changes were made to product functionality, user-facing features, or application behaviour.

Walkthrough

The Rhodibot workflow now pins actions/checkout to commit 3d3c42e5aac5ba805825da76410c181273ba90b1, with the v7.0.1 version comment retained.

Changes

Workflow action pinning

Layer / File(s) Summary
Pin checkout action
.github/workflows/rhodibot.yml
The checkout step uses the full commit SHA instead of the mutable v7.0.1 tag. No other workflow behaviour changed.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description explains the purpose and intended behaviour, but it does not follow the required template. It omits the required Summary, Changes, RSR Quality Checklist, and Testing sections. Screensh… Rewrite the description using the repository template. Include the Summary and Changes headings, complete the RSR Quality Checklist, and describe the testing performed. State that screenshots are not applicable if none are available.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main change: pinning third-party actions to full commit SHAs for CI policy compliance.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description explains the purpose and intended behaviour, but it does not follow the required template. It omits the required Summary, Changes, RSR Quality Checklist, and Testing sections. Screenshots are also not addressed.

  • ❌ Autofix failed (check again to retry)
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the workflow line
The checkout pin is now precise and fine
The version note stays in view
The commit keeps the action true
Small change, clear path, secure design

Comment @coderabbitai help to get the list of available commands.

@coderabbitai

coderabbitai Bot commented Sep 19, 2026

Copy link
Copy Markdown

The agent ran but didn't make any changes. The issues may already be fixed or require manual intervention.

@hyperpolymath
hyperpolymath merged commit 0ee8e9f into main Sep 19, 2026
27 of 32 checks passed
@hyperpolymath
hyperpolymath deleted the fix/sha-pin-actions branch September 19, 2026 22:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant