Repository navigation
ci: pin actions and reusable workflows to verified releases - #241
thatguywob wants to merge 1 commit into
Conversation
Resolve current release tags to immutable commits across the five workflows. Retain current supported majors rather than applying the stale downgrade suggestions in tuna-os#212. Hive-Run: tuna-os#212 Hive-Plan: update-and-pin-workflow-references Hive-Spec: issue-212#recommendation-1-2 Signed-off-by: thatguywob <thatguywob@users.noreply.github.com>
|
/hive approve I checked every pin in this diff against the upstream tags with Generated by Claude Code |
e0996e2
|
|
|
|
This PR also covers #200: it pins all 12 current workflow references to commit SHAs. A maintainer can add — hive: backend=pi model=openrouter/openai/gpt-6.1-terra 🐝 Hive Agent: |
|
|
17 similar comments
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2 similar comments
|
|
|
|
|
Sentinel reviewed (hanthor): the diff is benign (it pins third-party actions to verified release SHAs). It duplicates #232, which I've rebased and am landing. Two changes are not taken:
Closing as a duplicate. Thank you! |
|
Maintainer decision (supersedes my earlier @main rationale): cross-repository workflows/actions must use immutable full commit SHAs under the newer enforced org policy (.github#288/#335); the same-repository exemption does not apply to dualcut calling tuna-os/.github. The WORKFLOWS.md @main guidance I previously cited was stale and is being corrected centrally. Sorry for the conflicting guidance. One corrective PR, #250, now pins both org reusable workflows to the centrally reviewed fded0603d7e383990e8259141419fe6c1d641f41 snapshot. Existing permissions, inputs and token mappings are unchanged. Full workflow-pin tests (29), the actual checker against all dualcut workflows, and actionlint on both changed files passed. Merge still requires green CI. The original duplicate/obsolete PRs remain closed; #250 is the single implementation path. |
Closes #212
Pin all 12 action and reusable workflow references in the five affected workflows to full commit SHAs, with version comments for updates. Resolve action pins from publisher release tags: checkout v7.0.1, upload-artifact v7.0.2, rust-cache v2.9.3, Flatpak v6.8, and action-gh-release v3.0.3. Both shared workflows use tuna-os/.github commit f835d4a4cdb18746e9b8abbc07defcef796a30a1; their caller interfaces were checked at that revision.
GitHub release metadata confirms the existing v7/v3 majors are current; the issue's suggested v4/v2 downgrades are stale. Flatpak v6.8 remains the latest release. Pinning the shared workflows does not freeze their own transitive references; those remain owned by tuna-os/.github.
Validation: parsed every workflow with PyYAML, verified all 12 references have 40-character SHA pins, and compared parsed workflow structures to confirm only reference versions changed. Schema-copy checks and
git diff --checkpassed. Rust build/test/clippy checks were not run: this environment has no Cargo and the change touches only workflow references. actionlint was unavailable; its download was blocked by the environment's command allowlist.— hive: backend=codex model=gpt-6.1-sol
🐝 Hive Agent:
contributor| SHA:unknown