ci(workflow): pin autodeploy action version 📌

[glokos]

pins the autodeploy action to a specific commit sha, ensuring deterministic execution and preventing unexpected changes if the v2 tag is updated. this improves workflow reliability and security.

Summary by CodeRabbit

• Chores
  • Updated deployment infrastructure configuration to enhance stability and security by pinning action dependencies to specific verified versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d4be80a4-8330-4935-983e-84a08a7720f6

📥 Commits

Reviewing files that changed from the base of the PR and between afe86e5 and 5178eb5.

📒 Files selected for processing (1)

• .github/workflows/docker.yml

---

📝 Walkthrough

Walkthrough

A GitHub Actions workflow dependency reference was updated to use a pinned commit SHA instead of a version tag. The cowprotocol/autodeploy-action step now explicitly references a specific commit hash while maintaining all other step configurations unchanged.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow .github/workflows/docker.yml	Pinned cowprotocol/autodeploy-action from v2 tag to explicit commit SHA 0c950eb2856af4f520a652b59e786bd349516480 for reproducible deployments.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A pinned commit, precise and true,
No more surprises from version two,
Stability locked in, crisp and neat,
Reproducible deploys—a rabbit's treat! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately describes the main change: pinning the autodeploy action version to a specific commit SHA in the CI workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch assem/pin-gha-full-shas

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Critical CVE: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code in npm @babel/traverse CVE: GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (CRITICAL) Affected versions: < 7.23.2; >= 8.0.0-alpha.0 < 8.0.0-alpha.4 Patched version: 7.23.2 From: ? → npm/@nx/vite@16.5.0 → npm/jest@29.6.0 → npm/@nx/jest@16.3.2 → npm/@nx/js@16.3.2 → npm/@babel/traverse@7.22.6 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/traverse@7.22.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report