fix(ci): pin third-party actions to full commit SHAs - #9
Conversation
The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows could not run at all. This resolves each ref to the commit it currently points at and records the ref in a trailing comment, e.g. `actions/checkout@<sha> # v4`. `dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel. No behaviour is intended to change beyond the pins.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🧰 Additional context used🪛 zizmor (1.30.0).github/workflows/workflow-linter.yml[warning] 30-31: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) .github/workflows/ada-ci.yml[warning] 37-41: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 4-254: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [warning] 30-76: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [warning] 87-88: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 79-105: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [warning] 115-116: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 108-137: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [warning] 147-148: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 140-184: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [warning] 194-195: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 187-228: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) .github/workflows/dogfood-gate.yml[warning] 32-33: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 77-78: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 127-128: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 192-193: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 257-258: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 309-310: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) .github/workflows/static-analysis-gate.yml[warning] 25-28: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 149-152: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [warning] 275-278: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🔇 Additional comments (5)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request replaces mutable GitHub Actions version tags with immutable commit SHAs in five workflow files. Each reference retains a trailing semantic-version comment. Workflow logic and triggers remain unchanged. ChangesGitHub Actions workflow pinning
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Bug fix Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit reads each line, Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
fix(ci): pin third-party actions to full commit SHAs
The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup —
startup_failure, no jobs, "this workflow graph cannot be shown" — so these workflowscould not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g.
actions/checkout@<sha> # v4.dtolnay/rust-toolchaintakes its toolchain from the ref itself, so those steps also gained anexplicit
with: toolchain:input; without it, a SHA ref would silently lose the channel.No behaviour is intended to change beyond the pins.