ci: SHA-pin all workflow templates so UI adoption is pinact-clean#60
Merged
Conversation
The New-workflow picker copies templates verbatim, so @v1 made every UI adoption fail the adopter's Action Pinning Check. Pin all workflow-templates/ uses refs to @92c8c6d # v1.16.0, and extend .pinact.yml files: to cover workflow-templates/ so the templates stay pinned going forward. geolonia/* is min-age-exempt, so the fresh release is fine; each adopting repo's Dependabot keeps its copy current from there. Verified locally: pinact run --fix=false --verify --verify-min-age -> exit 0. Closes #59
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (9)
WalkthroughThis PR adds workflow template pinning for reproducibility. ChangesWorkflow Template SHA Pinning
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Secret Leak CheckOK No secrets detected in this PR's diff. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #59
What
SHA-pins every "New workflow (by Geolonia)" template so adopting one via the
GitHub UI produces a pinact-clean PR with no manual
pinact run.workflow-templates/*.ymluses:refs:@v1→@92c8c6d # v1.16.0..pinact.yml: add afiles:list (defaults +workflow-templates/*) so thetemplates themselves are now verified by the Action Pinning Check.
Why
The picker copies templates verbatim and GitHub can't pin at add-time, so
@v1made every UI adoption fail the adopter's pinact gate.
geolonia/*is alreadymin-age-exempt, so pinning to a fresh release is allowed. Each adopting repo's
Dependabot bumps its own copy from there.
Verification
pinact run --fix=false --verify --verify-min-age→ exit 0 locally (and thisPR's own Action Pinning Check now covers the templates).
Follow-up (not in this PR)
Dependabot can't scan
workflow-templates/, so these template SHAs won'tauto-update. A release-time job that re-pins
workflow-templates/on each newtag would keep them fresh — happy to add it separately.
Summary by CodeRabbit
Chores