ci: pin action versions#1657
Merged
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughThis PR pins GitHub Actions to specific commit SHAs across three CI/CD workflow files (build.yml, prcheck.yml, release.yml), replacing floating version tags with deterministic commit references. Build steps, artifact names/paths, and Node.js versions remain unchanged. ChangesGitHub Actions Workflow Pinning
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yml:
- Line 39: Add the missing persist-credentials setting to each checkout step
using the actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd invocation:
update those steps to include a with: block specifying persist-credentials:
false so credentials are not written to git config; apply the same change to the
other workflow files that have checkout steps (the same actions/checkout SHA) to
ensure consistency across build, prcheck, and release workflows.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 91da25fa-73a5-488f-9181-9595b5a7c03b
📒 Files selected for processing (3)
.github/workflows/build.yml.github/workflows/prcheck.yml.github/workflows/release.yml
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/build.yml (1)
39-50:⚠️ Potential issue | 🟠 MajorFix pnpm/action-setup version-tag SHA mismatch in build.yml
- In
.github/workflows/build.yml(lines 39-50),pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093is labeled# v6.0.8, but tagv6.0.8resolves tod15e628ca66d93ee5f352c71671a7bc6a97af5c9; update the pinned SHA or the version comment.- GitHub
vulnerabilityAlertsreturned no alerts foractions/checkout,actions/setup-node,pnpm/action-setup, andactions/upload-artifact.- Re-check the other workflow occurrences (lines 114-125 and 178-189) for the same tag/commit mismatch.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yml around lines 39 - 50, The pinned SHA for pnpm/action-setup (pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093) does not match the comment “# v6.0.8”; update the workflow to either pin the correct commit for v6.0.8 (replace the SHA with d15e628ca66d93ee5f352c71671a7bc6a97af5c9) or change the comment to reflect the actual SHA being used; apply the same fix to any other occurrences of pnpm/action-setup in this file to keep tags and SHAs consistent and run a quick check that actions/checkout and actions/setup-node comments match their pinned SHAs too.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/build.yml:
- Around line 39-50: The pinned SHA for pnpm/action-setup
(pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093) does not match the
comment “# v6.0.8”; update the workflow to either pin the correct commit for
v6.0.8 (replace the SHA with d15e628ca66d93ee5f352c71671a7bc6a97af5c9) or change
the comment to reflect the actual SHA being used; apply the same fix to any
other occurrences of pnpm/action-setup in this file to keep tags and SHAs
consistent and run a quick check that actions/checkout and actions/setup-node
comments match their pinned SHAs too.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7197925c-6fa7-450d-80c6-6660fe7d815f
📒 Files selected for processing (3)
.github/workflows/build.yml.github/workflows/prcheck.yml.github/workflows/release.yml
Contributor
Author
See: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Given the recent supply chain attacks, I think we should pin all actions we use.
https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials
Updated via pinact.
Summary by CodeRabbit