Fix CI/CD pipeline dependencies#41
Conversation
- Update `macos-13` to `macos-15-intel` since the `macos-13` runner is deprecated/removed and we need an x86_64 target. - Update `softprops/action-gh-release@v1` to `v2` to avoid Node.js 16 deprecation warning. These fixes restore the robustness and dependability of the existing CI/CD pipeline that builds artifacts and updates Homebrew and NixOS package managers.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
📝 WalkthroughWalkthroughThe CI workflow is updated with two configuration changes: the macOS Intel runner in the build matrix advances from ChangesCI Workflow Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
The CI/CD pipeline updates look good. The changes appropriately address the deprecation issues by upgrading macos-13 to macos-15-intel (maintaining x86_64 architecture) and action-gh-release from v1 to v2 (addressing Node 16 deprecation). These updates maintain the existing functionality while ensuring pipeline reliability.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 125: Replace floating GitHub Actions refs with immutable 40-character
commit SHAs: locate the three `uses:` entries `actions/upload-artifact@v4`,
`DeterminateSystems/nix-installer-action@main`, and
`softprops/action-gh-release@v2` in the workflow and update each to the
corresponding full commit SHA (e.g., `actions/upload-artifact@<40-char-sha>`).
Fetch the exact SHA from each action's repository (via the GitHub UI or git
ls-remote) and substitute the tag/branch with that SHA in the YAML so the
workflow uses a pinned, immutable reference.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
|
|
||
| - name: Create Release | ||
| uses: softprops/action-gh-release@v1 | ||
| uses: softprops/action-gh-release@v2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether any workflow actions are not pinned to a full 40-char SHA.
# Expected: no output after remediation.
rg -nP '^\s*uses:\s*[^@]+@(?!(?:[a-f0-9]{40})\b).+$' .github/workflows/*.yml
# Resolve current commit behind softprops/action-gh-release v2 tag (read-only).
# Expected: prints the commit SHA to pin.
curl -s https://api.github.com/repos/softprops/action-gh-release/git/ref/tags/v2 | jq -r '.object.sha'Repository: clpi/dopl
Length of output: 253
Pin GitHub Actions uses: references to immutable commit SHAs
.github/workflows/ci.yml contains floating action refs (not full 40-char SHAs): actions/upload-artifact@v4 (line 95), DeterminateSystems/nix-installer-action@main (line 102), and softprops/action-gh-release@v2 (line 125). Pin each to the full commit SHA to prevent tag/branch retargeting.
Suggested fix
- uses: softprops/action-gh-release@v2
+ # v2
+ uses: softprops/action-gh-release@<full_commit_sha>🧰 Tools
🪛 zizmor (1.25.2)
[error] 125-125: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[info] 125-125: action functionality is already included by the runner (superfluous-actions): use gh release in a script step
(superfluous-actions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 125, Replace floating GitHub Actions refs
with immutable 40-character commit SHAs: locate the three `uses:` entries
`actions/upload-artifact@v4`, `DeterminateSystems/nix-installer-action@main`,
and `softprops/action-gh-release@v2` in the workflow and update each to the
corresponding full commit SHA (e.g., `actions/upload-artifact@<40-char-sha>`).
Fetch the exact SHA from each action's repository (via the GitHub UI or git
ls-remote) and substitute the tag/branch with that SHA in the YAML so the
workflow uses a pinned, immutable reference.
There was a problem hiding this comment.
Pull request overview
Updates the CI/CD workflow to replace deprecated GitHub Actions infrastructure: swaps the retired macos-13 runner for macos-15-intel (preserving the x86_64-darwin build target) and bumps softprops/action-gh-release from v1 to v2 to avoid Node 16 deprecation.
Changes:
- Replace
macos-13runner withmacos-15-intelfor thex86_64-darwinmatrix entry. - Upgrade
softprops/action-gh-releasefromv1tov2.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Fixed the CI/CD pipeline by updating the deprecated
macos-13runner tomacos-15-intelto keep the x86_64-darwin target, and upgraded theaction-gh-releasestep tov2to avoid the Node 16 deprecation. The requested functionality (Homebrew, NixOS via flake.nix, fpm packages) is already present in the pipeline; fixing these deprecations makes it dependable again.PR created automatically by Jules for task 2091794382315950984 started by @clpi
Summary by CodeRabbit