actions.yml: drop stale stable tag on dtolnay/rust-toolchain - #1163
Open
potiuk wants to merge 1 commit into
Open
actions.yml: drop stale stable tag on dtolnay/rust-toolchain#1163potiuk wants to merge 1 commit into
potiuk wants to merge 1 commit into
Conversation
Upstream publishes `stable` as a rolling branch and force-pushes it on each toolchain release. The pinned SHA stopped being an ancestor of that branch, so check_action_tags hard-failed on every PR in the repo, not just ones touching this entry - seven open PRs were red for a reason none of them caused. Without a `tag:` key the checker only verifies the commit exists and emits a warning, which is the accurate statement: the commit is immutable and still valid to pin, it is simply no longer on any ref. Deliberately not bumping to the current `stable` head. That would approve an unreviewed version of the action for every ASF project, which is a version bump needing its own review rather than a CI fix. Also regenerates approved_patterns.yml, which drops zizmor-action v0.5.3 (b1d7e1fb) - its expires_at was today, unrelated to this change. Generated-by: Claude Opus 5 (1M context) via Claude Code
Member
Author
|
Would bae great to get that one merged quickly to avoid all PRs being red. |
This was referenced Aug 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
check_action_tagsis currently failing on every open PR:Upstream publishes
stableas a rolling branch and force-pushes it on eachtoolchain release. The SHA was pinned on 2026-07-19 when it was the branch
head;
stablehas since moved to4360b525, so the annotation no longerholds and the checker hard-fails the whole run. Seven open PRs (#1145, #1147,
#1148, #1150, #1157, #1158, #1161) are red for a reason none of them caused,
and every new PR inherits it.
The change
Drop the
tag: stableannotation from the pinned SHA. With notag:key,action_tags.pyverifies only that the commit exists and emits a warning(
action_tags.py:208-216) rather than validating ancestry against a branch.That is the accurate statement: commit
4cda84d5is immutable and still validto pin, it is simply no longer on any ref.
What this deliberately does not do
It does not bump to the current
stablehead. That would add an unreviewedversion of the action to the allowlist for every ASF project - a version bump
needing its own review, not something to smuggle in as a CI fix. Consumers are
pinned to the SHA via
approved_patterns.yml, so nothing downstream changes.This will recur on the next force-push if the entry is ever re-annotated with
a rolling ref. Upstream ships exactly one tag (
v1) and uses branches foreverything else, so pinning by SHA without a
tag:is the stable arrangementhere.
Note on the diff
approved_patterns.ymlalso loseszizmorcore/zizmor-action@b1d7e1fb(v0.5.3). Its
expires_atwas 2026-08-09, so the gateway regeneration dropsit. Unrelated to this fix, but the sync produces it either way.
Test plan
prek run --all-filesclean.gatewaysync theupdateworkflowruns (
update_actions/update_workflow/update_patterns).4cda84d5still resolves via the commits API (HTTP 200), which isthe path that now yields a warning instead of a failure.