Every consumer of the rainix reusable workflows references them at @main:
uses: rainlanguage/rainix/.github/workflows/rainix-copy-artifacts.yaml@main
and rainix-copy-artifacts.yaml in turn uses rainlanguage/rainix/.github/actions/nix-cachix-setup@main. These jobs carry the calling repository's secrets, so a change to rainix main executes with each consumer's trust and secret context on that consumer's next push, with no review on their side.
The org already applies this discipline to one of the two things it could apply it to: the nix shell is pinned by exact commit through RAINIX_SHA (dbcd9d3cf55da4c40e42519b320cea8bdcd9a193 today), and there is a ci: bump RAINIX_SHA to … convention for moving it. The workflow and action refs have no equivalent.
Scope is a policy decision rather than a single edit — it reaches every uses: line in every rain repo, and whatever replaces @main needs a bump mechanism like RAINIX_SHA has, or it rots.
Raised by CodeRabbit against rainlanguage/rain.extrospection.deploy#8; declined there as org-wide.
Every consumer of the rainix reusable workflows references them at
@main:and
rainix-copy-artifacts.yamlin turn usesrainlanguage/rainix/.github/actions/nix-cachix-setup@main. These jobs carry the calling repository's secrets, so a change to rainixmainexecutes with each consumer's trust and secret context on that consumer's next push, with no review on their side.The org already applies this discipline to one of the two things it could apply it to: the nix shell is pinned by exact commit through
RAINIX_SHA(dbcd9d3cf55da4c40e42519b320cea8bdcd9a193today), and there is aci: bump RAINIX_SHA to …convention for moving it. The workflow and action refs have no equivalent.Scope is a policy decision rather than a single edit — it reaches every
uses:line in every rain repo, and whatever replaces@mainneeds a bump mechanism likeRAINIX_SHAhas, or it rots.Raised by CodeRabbit against rainlanguage/rain.extrospection.deploy#8; declined there as org-wide.