Skip to content

Pin shared-actions SHA in CI to current #390

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
leynos wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Pin shared-actions SHA in CI to current #390

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
steps:
- uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
- name: Setup Rust
uses: leynos/shared-actions/.github/actions/setup-rust@718c4f2eadaf95d527814862fd7cb85d91c8a8fc
uses: leynos/shared-actions/.github/actions/setup-rust@4b35232

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use full commit SHAs for shared actions

When this workflow runs on pull requests or workflow_dispatch, GitHub Actions no longer supports shortened commit SHAs for uses: action references; GitHub's changelog says these references must use the full commit SHA (https://github.blog/changelog/2021-01-21-github-actions-short-sha-deprecation/). The same 7-character ref is used for the other shared-action steps too, so CI can fail while resolving the action before any checks run. Pin this to the full 4b35232912c61d595b49f8a54bce3c201a95fd42 SHA instead.

Useful? React with 👍 / 👎.

@coderabbitai coderabbitai Bot Jun 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check the current state of .github/workflows/ci.yml
echo "=== Content of lines 32, 51, 59, 80 in ci.yml ==="
cat -n .github/workflows/ci.yml | sed -n '32p;51p;59p;80p'

echo
echo "=== Full shared-actions uses entries ==="
rg -n 'uses:\s*leynos/shared-actions/.github/actions/.+@' .github/workflows

echo
echo "=== Check for short SHAs (not 40 chars) ==="
rg -nP 'uses:\s*leynos/shared-actions/.github/actions/.+@[0-9a-f]{1,39}\b' .github/workflows

Repository: leynos/netsuke

Length of output: 2283

Replace short SHAs with full 40-character commit SHAs in all uses: references.

Lines 32, 51, 59, and 80 use a 7-character prefix (@4b35232). Pin each action to the full commit SHA to enforce immutability and match the pinning standard used across other workflows.

Verification script 
#!/bin/bash
# Verify shared-actions refs are pinned and use full 40-char SHAs.
# Expected: no output from the second check.

echo "Shared-actions uses entries:"
rg -n 'uses:\s*leynos/shared-actions/.github/actions/.+@' .github/workflows

echo
echo "Entries that are NOT pinned to a full 40-char SHA (should be empty):"
rg -nP 'uses:\s*leynos/shared-actions/.github/actions/.+@[0-9a-f]{1,39}\b' .github/workflows

Also applies to: 51-51, 59-59, 80-80

🧰 Tools
🪛 zizmor (1.25.2)

[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 32, Replace all instances of the short
7-character commit SHA with the full 40-character commit SHA in the
leynos/shared-actions workflow references. In the ci.yml file, locate all four
occurrences where uses: leynos/shared-actions/.github/actions/ references end
with `@4b35232` (on lines 32, 51, 59, and 80). For each occurrence, expand the
`@4b35232` reference to include the complete 40-character commit SHA to enforce
immutability and meet the pinning standard used throughout the workflows.

Source: Linters/SAST tools

with:
toolchain: ${{ matrix.rust }}
components: rustfmt, clippy
Expand All @@ -48,15 +48,15 @@ jobs:
run: make test
- name: Test and Measure Coverage
if: matrix.rust == 'stable'
uses: leynos/shared-actions/.github/actions/generate-coverage@718c4f2eadaf95d527814862fd7cb85d91c8a8fc
uses: leynos/shared-actions/.github/actions/generate-coverage@4b35232
with:
output-path: lcov.info
format: lcov
- name: Upload coverage data to CodeScene
env:
CS_ACCESS_TOKEN: ${{ secrets.CS_ACCESS_TOKEN }}
if: matrix.rust == 'stable' && env.CS_ACCESS_TOKEN != ''
uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@718c4f2eadaf95d527814862fd7cb85d91c8a8fc
uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@4b35232
with:
format: lcov
access-token: ${{ env.CS_ACCESS_TOKEN }}
Expand All @@ -77,7 +77,7 @@ jobs:
with:
persist-credentials: false
- name: Setup Rust
uses: leynos/shared-actions/.github/actions/setup-rust@718c4f2eadaf95d527814862fd7cb85d91c8a8fc
uses: leynos/shared-actions/.github/actions/setup-rust@4b35232
with:
toolchain: stable
- name: Install uv
Expand Down
Loading