fix(ci): reconcile the workflows with actions.lock (gh-actions-lock) - #111
Conversation
…0.1.6) `actions.lock` is authoritative: the workflows carry readable refs and the lock records the commit each ref resolves to, which is what actually runs. Refs that stop matching the manifest make the whole repository unstartable — `startup_failure`, "Invalid lockfile". Regenerated with the official extension (`github/gh-actions-lock`). The hand-pinned SHA refs are reverted to their readable form here precisely because the lockfile, not the workflow, is what pins them.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (28)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (38)
🧰 Additional context used🪛 GitHub Check: SonarCloud Code Analysis.github/workflows/release.yml[failure] 144-144: Use full commit SHA hash for this dependency. .github/workflows/quality.yml[failure] 34-34: Use full commit SHA hash for this dependency. [failure] 51-51: Use full commit SHA hash for this dependency. .github/workflows/instant-sync.yml[failure] 35-35: Use full commit SHA hash for this dependency. .github/workflows/dependabot-automerge.yml[failure] 60-60: Use full commit SHA hash for this dependency. .github/workflows/static-analysis-gate.yml[failure] 160-160: Use full commit SHA hash for this dependency. 🔇 Additional comments (2)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request updates GitHub Actions workflow headers and action references. Most workflows now use version tags instead of commit SHAs. The release workflow changes its references to immutable commit SHAs. One leading blank line was removed. ChangesWorkflow reference updates
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~15 minutes Change: Bug fix 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description explains the purpose and main change, but it does not follow the required template. It omits the required Changes, RSR Quality Checklist, Testing, and Screenshots sections, including all required checklist items. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the workflow trail Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
2 participants
fix(ci): reconcile the workflows with actions.lock (gh-actions-lock v0.1.6)
actions.lockis authoritative: the workflows carry readable refs and the lock records thecommit each ref resolves to, which is what actually runs. Refs that stop matching the manifest
make the whole repository unstartable —
startup_failure, "Invalid lockfile".Regenerated with the official extension (
github/gh-actions-lock). The hand-pinned SHA refs arereverted to their readable form here precisely because the lockfile, not the workflow, is what
pins them.