Repository navigation
ci: pin the shared reusable workflows to the v1 commit - #14
Conversation
Follow-up to #11, addressing its two open CodeRabbit threads: ci.yml (node-ci), security.yml and workflows-lint.yml called rishitank/.github at the mutable `@v1` tag. Pin all three to 5c644123ed93759cf78aa32d9d119150910e113e, the commit v1 resolves to, with a `# v1` comment. The house Renovate preset (helpers:pinGitHubActionDigests) keeps the digest current, so tag moves still arrive, as reviewed PRs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (3)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (4)
🔇 Additional comments (3)
📝 SummarySummary by CodeRabbit
WalkthroughThree GitHub Actions workflows now pin their shared workflow reference to commit ChangesReusable workflow pinning
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Other Merge Risk: ⚪ Minimal · up to The workflows remain pinned to the current 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Apprentice, the workflows hold their course, Comment |
🧪 Runtime gate✅ Runtime crawl: no runtime errors1 page(s) opened in a real browser (desktop + phone), safe controls exercised, forms tried with dummy data, links followed client-side, missing-route probe run. 37s. Coverage: 1/1 routes · 0/0 controls operated · 0/0 forms submitted · 29.3% of the app's own JavaScript executed Against the default branch: routes ±0, controls ±0, JS ±0 pts. No visual changes against the last default-branch run. Pages visited
AI explorer not run: no major/framework signal in this PR. Add the Screenshots, diffs and the app log: runtime-gate artifact. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Why
#11 merged with two CodeRabbit threads still open. Both say the same thing: the three callers of
rishitank/.githubuse the mutable@v1tag, so a tag move can change the workflow code that runs here without any change in this repository. GitHub recommends a full commit SHA for reusable workflows, and zizmor flags these asunpinned-uses.That is valid. Pinning does not lose the "pick up shared fixes" benefit of
@v1: the house Renovate preset (helpers:pinGitHubActionDigests) keeps the digest current, so a tag move now arrives as a reviewed Renovate PR instead of silently.What changed
.github/workflows/ci.yml:node-ci.yml@v1becomesnode-ci.yml@5c644123ed93759cf78aa32d9d119150910e113e # v1..github/workflows/security.yml:security.yml@v1, pinned the same way..github/workflows/workflows-lint.yml:workflows-lint.yml@v1, pinned the same way.5c644123is the commit thev1tag resolves to today, so the code that runs is unchanged.runtime.ymlalready pins a SHA and is untouched. actionlint is clean.🤖 Generated with Claude Code
https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi