ci: pin taiki-e/install-action to commit SHA

[jdx]

Summary

• Pin taiki-e/install-action@cargo-llvm-cov to a full-length commit SHA in coverage.yml. The cargo-llvm-cov ref is a tool-alias tag the action's CI auto-bumps; SHA-pinning is required by org policy regardless.

Test plan

• coverage workflow still installs cargo-llvm-cov and reports coverage on next push

🤖 Generated with Claude Code

---

Note

Low Risk
Low risk CI-only change that pins a GitHub Action to a specific commit; impact is limited to whether the coverage job can still install cargo-llvm-cov.

Overview
Pins the coverage workflow’s taiki-e/install-action step for installing cargo-llvm-cov from the moving @cargo-llvm-cov ref to a specific commit SHA, improving supply-chain/CI determinism.

No other workflow behavior changes (coverage generation and Codecov upload remain the same).

^{Reviewed by Cursor Bugbot for commit 252557c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 252557c. Configure here.}

[cursor]

Missing tool input when SHA-pinning install-action

High Severity

Switching taiki-e/install-action from the @cargo-llvm-cov tag ref to a commit SHA loses the tool name that was previously conveyed by the tag itself. The comment # cargo-llvm-cov is only a human-readable annotation and doesn't configure anything. Without a with: tool: cargo-llvm-cov block, the action won't know which tool to install, and the coverage workflow will fail.

 

^{Reviewed by Cursor Bugbot for commit 252557c. Configure here.}

[greptile-apps]

Greptile Summary

This PR pins taiki-e/install-action@cargo-llvm-cov to the full commit SHA d79fce544138636ae8155ecac335f73c98e3b198, preserving the original tag as a comment. Every other action in coverage.yml was already SHA-pinned, so this change brings the workflow into full compliance with the org's supply-chain security policy.

Confidence Score: 5/5

Safe to merge — single-line CI hardening with no functional changes.

The diff is a one-line change that replaces a mutable tag with an immutable SHA, consistent with the existing pinning pattern. No logic is altered and no new risks are introduced.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/coverage.yml	Pins taiki-e/install-action from the mutable cargo-llvm-cov tag to a full 40-character commit SHA, matching the pinning style of every other action in the workflow.

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Actions Runner
    participant RI as taiki-e/install-action
    participant CC as Codecov

    GH->>RI: checkout action at SHA d79fce5... (cargo-llvm-cov)
    RI-->>GH: cargo-llvm-cov installed
    GH->>GH: mise run coverage (generates codecov.json)
    GH->>CC: upload coverage report (codecov/codecov-action SHA-pinned)
    CC-->>GH: coverage accepted

Loading

_{Reviews (1): Last reviewed commit: "ci: pin taiki-e/install-action to commit..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.03%. Comparing base (86b24de) to head (252557c).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #610   +/-   ##
=======================================
  Coverage   79.03%   79.03%           
=======================================
  Files          48       48           
  Lines        7235     7235           
  Branches     7235     7235           
=======================================
  Hits         5718     5718           
  Misses       1140     1140           
  Partials      377      377           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.