fix(ci): pin third-party actions to full commit SHAs - #79
Conversation
The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows could not run at all. This resolves each ref to the commit it currently points at and records the ref in a trailing comment, e.g. `actions/checkout@<sha> # v4`. `dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel. No behaviour is intended to change beyond the pins.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (4)
|
| Layer / File(s) | Summary |
|---|---|
Pin checkout action .github/workflows/rhodibot.yml |
The checkout step uses the full commit SHA instead of the mutable v7.0.1 tag. No other workflow behaviour changed. |
Priority: ⬇️ Low
Estimated code review effort: 1 (Trivial) | ~5 minutes
Change: Bug fix
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check | The description explains the purpose and intended behaviour, but it does not follow the required template. It omits the required Summary, Changes, RSR Quality Checklist, and Testing sections. Screensh… | Rewrite the description using the repository template. Include the Summary and Changes headings, complete the RSR Quality Checklist, and describe the testing performed. State that screenshots are not applicable if none are available. |
✅ Passed checks (4 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly identifies the main change: pinning third-party actions to full commit SHAs for CI policy compliance. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
Full details: Description check
Explanation
The description explains the purpose and intended behaviour, but it does not follow the required template. It omits the required Summary, Changes, RSR Quality Checklist, and Testing sections. Screenshots are also not addressed.
- ❌ Autofix failed (check again to retry)
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
- Commit to this branch
- Create a new PR
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the workflow line
The checkout pin is now precise and fine
The version note stays in view
The commit keeps the action true
Small change, clear path, secure design
Comment @coderabbitai help to get the list of available commands.
|
The agent ran but didn't make any changes. The issues may already be fixed or require manual intervention. |
fix(ci): pin third-party actions to full commit SHAs
The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup —
startup_failure, no jobs, "this workflow graph cannot be shown" — so these workflowscould not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g.
actions/checkout@<sha> # v4.dtolnay/rust-toolchaintakes its toolchain from the ref itself, so those steps also gained anexplicit
with: toolchain:input; without it, a SHA ref would silently lose the channel.No behaviour is intended to change beyond the pins.