fix(ci): pin third-party actions to full commit SHAs - #13
Conversation
|
Warning Review limit reachedNext included review available in 23 minutes. View limit detailsLimit details: You’ve used the included review currently available. This review ran on the free tier because your account doesn't have an assigned seat on this organization's plan. Waiting won't change this — ask an organization admin to assign you a seat, then retry. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Free Run ID: 📒 Files selected for processing (4)
Note 🎁 Summarized by CodeRabbit FreeThe PR author is not assigned a seat. If you are a newly provisioned user and your organization has automatic seat assignment enabled, open a new pull request to trigger seat assignment. Otherwise, ask an organization administrator to assign a seat through the team management page at https://app.coderabbit.ai/settings/team-management. Comment |
…0.1.6) `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them.
2986eb0 to
6c5c932
Compare
1 participant
fix(ci): pin third-party actions to full commit SHAs
The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at
startup —
startup_failure, no jobs, "this workflow graph cannot be shown" — so these workflowscould not run at all. This resolves each ref to the commit it currently points at and records the
ref in a trailing comment, e.g.
actions/checkout@<sha> # v4.dtolnay/rust-toolchaintakes its toolchain from the ref itself, so those steps also gained anexplicit
with: toolchain:input; without it, a SHA ref would silently lose the channel.No behaviour is intended to change beyond the pins.