ci: use hash-pinned actions - #43
Merged
Merged
Conversation
dependabot: consolidate updated using groups
Contributor
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThe PR consolidates Dependabot updates for shared GitHub dependencies and replaces mutable action/workflow tags with hash-pinned revisions annotated with their release versions. It also changes local reusable-workflow references in CI and publishing workflows to use Flow diagram for grouped Dependabot updatesflowchart LR
Dependabot[Dependabot GitHub Actions updates]
ActionsGroup[coatl-dev/actions group]
WorkflowsGroup[coatl-dev/workflows group]
ActionDeps[Shared action dependencies]
WorkflowDeps[Shared reusable workflow dependencies]
Dependabot --> ActionsGroup
Dependabot --> WorkflowsGroup
ActionsGroup --> ActionDeps
WorkflowsGroup --> WorkflowDeps
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/ci.yml" line_range="17" />
<code_context>
tox:
if: ${{ github.event_name == 'pull_request' }}
- uses: ./.github/workflows/tox.yml
+ uses: $/.github/workflows/tox.yml
</code_context>
<issue_to_address>
**issue (bug_risk):** The reusable-workflow references use `$/...` instead of the required repository-relative `./.github/...` path, so GitHub rejects both workflows and the local `tox.yml` workflow is never called.
**Suggested fix:** Change both references to `./.github/workflows/tox.yml`.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and the change replaces valid local reusable-workflow references with $/..., likely breaking CI and release workflows, and it upgrades pinned actions that run with PyPI credentials. A bad or malicious pin could expose the token or publish incorrect artifacts, and reverting would not undo those external effects.
Blocking findings: .github/workflows/ci.yml:17
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
|
||
| tox: | ||
| if: ${{ github.event_name == 'pull_request' }} | ||
| uses: ./.github/workflows/tox.yml |
Contributor
There was a problem hiding this comment.
issue (bug_risk): The reusable-workflow references use $/... instead of the required repository-relative ./.github/... path, so GitHub rejects both workflows and the local tox.yml workflow is never called.
Suggested fix: Change both references to ./.github/workflows/tox.yml.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot: consolidate updated using groups
Summary by Sourcery
Harden GitHub Actions dependency management by adopting hash-pinned workflow references and consolidated Dependabot updates.
Enhancements:
CI: