ci: bump actions/setup-node to v6.4.0 (zizmor ref-version-mismatch fix)#158
Merged
Palbahngmiyine merged 2 commits intosolapi:betafrom Apr 20, 2026
Merged
Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
…ismatch zizmor v1.24.1의 `ref-version-mismatch` 룰이 pinned SHA와 주석 버전 불일치를 감지하여 경고 7건이 GitHub Actions Security job을 exit 13으로 실패시킴. 이전 상태: - SHA `53b83947...` = actions/setup-node v6.3.0 - 주석 `# v6`은 현재 v6 floating tag가 가리키는 v6.4.0 암시 해결: - actions/setup-node를 v6.4.0(`48b55a011bda`)으로 실제 업그레이드 - 주석도 구체적 `# v6.4.0`으로 정합 - v6.4.0은 의존성 업데이트(@actions/*, Node 버전 versions.yml) 외 breaking change 없는 minor release 적용 파일(7곳): - .github/workflows/ci.yml L37, L69, L112 - .github/workflows/release.yml L120, L192, L250 - .github/workflows/build-docs.yaml L30 관련 실패 run: solapi/solapi-nodejs 24647689822 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Palbahngmiyine
force-pushed
the
fix/zizmor-ref-version-mismatch
branch
from
ead8fdb to
82c46c4
Compare
Palbahngmiyine
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
zizmor v1.24.1의
ref-version-mismatch감사 규칙이actions/setup-node의 pinned SHA와 주석 버전이 서로 다른 릴리즈를 가리키는 것을 감지하여 GitHub Actions Security job이 exit code 13으로 실패. 이번 PR은 SHA를 v6.4.0으로 실제 업그레이드하고 주석을 정합시켜 해결합니다.관련 실패 run: GitHub Actions Security #24647689822 (chore(beta): release solapi 6.0.0-beta.4)
원인
53b83947a5a98c8d113130e565377fae1a50d02f→ actions/setup-node v6.3.0# v6→ v6 floating tag는 현재 v6.4.0 (48b55a011bda)을 가리킴수정 — v6.4.0으로 업그레이드
.github/workflows/ci.yml.github/workflows/release.yml.github/workflows/build-docs.yaml7곳 모두:
v6.4.0 안전성 검토
릴리즈 노트 확인:
@actions/*내부 의존성 업데이트versions.yml의 Node.js 버전 최신화검증 (zizmor 공식 문서)
ref-version-mismatch(https://docs.zizmor.sh/audits)v6.4.0)로 동기화하여 장기적으로 재발 방지.🤖 Generated with Claude Code