Pin GitHub Actions with SHAs and configure Dependabot#381
Pin GitHub Actions with SHAs and configure Dependabot#381koji-1009 wants to merge 3 commits intosubosito:mainfrom
Conversation
|
No actionable comments were generated in the recent review. 🎉 📝 WalkthroughWalkthroughAdds a Dependabot config to automate GitHub Actions updates and pins GitHub Action references to specific commit hashes in workflow and action metadata files for deterministic resolution (no runtime logic or public API changes). Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/workflow.yaml (1)
22-22:# mastercomment onludeeus/action-shellcheckcarries no version/date signal.A bare
# masterdoesn't help future readers or Dependabot reason about when this SHA was captured. If a semver tag exists, prefer# vX.Y.Z; if not, appending an ISO date (e.g.# master @ 2026-01-xx) makes the staleness visible.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/workflow.yaml at line 22, The workflow line using "uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca" currently has an uninformative comment "# master"; update that comment to convey a meaningful version or capture date so future readers/Dependabot can reason about staleness—for example, replace "# master" with a semver tag like "# vX.Y.Z" if a release tag exists for ludeeus/action-shellcheck, or append an ISO date like "# master @ 2026-01-xx" to indicate when this SHA was recorded; locate the entry containing "uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca" and adjust the trailing comment accordingly..github/dependabot.yml (1)
5-7: Consider adding acommit-messageprefix to align with repo conventions.Without
commit-messageconfiguration, Dependabot will use its default message format. Adding a prefix keeps update commits consistent with any conventional-commit style in use.♻️ Suggested addition
schedule: interval: weekly + commit-message: + prefix: chore open-pull-requests-limit: 10🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/dependabot.yml around lines 5 - 7, Add a commit-message configuration to the Dependabot update block so update commits follow the repo's conventional-commit style: next to the existing schedule and open-pull-requests-limit keys add a commit-message mapping (e.g., commit-message: { prefix: "chore(deps)" } or include both prefix and prefix-development) so Dependabot uses "chore(deps): ..." as the commit title instead of its default format; update the block that currently contains schedule and open-pull-requests-limit to include this new commit-message key.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@action.yaml`:
- Line 119: Update release notes and documentation to call out the minimum
GitHub Actions Runner requirement for the pinned actions/cache release: the
referenced pinned SHA (cdf6c1fa76f9f475f3d7449005a359c84ca0f306) which maps to
actions/[email protected] (actions/cache@v5) requires Node.js 24 and a minimum runner
version of 2.327.1; add a clear note near the use of actions/[email protected] (and
any similar pinned entries) stating that self-hosted runners below 2.327.1 will
fail and provide guidance to upgrade runners or pin to an earlier actions/cache
major version.
---
Nitpick comments:
In @.github/dependabot.yml:
- Around line 5-7: Add a commit-message configuration to the Dependabot update
block so update commits follow the repo's conventional-commit style: next to the
existing schedule and open-pull-requests-limit keys add a commit-message mapping
(e.g., commit-message: { prefix: "chore(deps)" } or include both prefix and
prefix-development) so Dependabot uses "chore(deps): ..." as the commit title
instead of its default format; update the block that currently contains schedule
and open-pull-requests-limit to include this new commit-message key.
In @.github/workflows/workflow.yaml:
- Line 22: The workflow line using "uses:
ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca" currently
has an uninformative comment "# master"; update that comment to convey a
meaningful version or capture date so future readers/Dependabot can reason about
staleness—for example, replace "# master" with a semver tag like "# vX.Y.Z" if a
release tag exists for ludeeus/action-shellcheck, or append an ISO date like "#
master @ 2026-01-xx" to indicate when this SHA was recorded; locate the entry
containing "uses:
ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca" and adjust
the trailing comment accordingly.
|
In #371:
This PR pins action references to commit SHAs and adds a Dependabot configuration to keep them updated automatically. Commit hash pinning and Dependabot work well together — Dependabot understands SHA-pinned actions and will propose updates with the correct new hash and version comment. For example, once this is merged, Dependabot will automatically create a PR to update |
This is a speculation, in the very next sentence of the very same message you're citing, this repo's maintainer argues against SHA pinning. Let me cite both sentences that came in a row in this message:
So the maintainer is clear that he doesn't mind |
|
OK. I close this PR. |
2 participants
Hello. This PR improves security and maintenance for GitHub Actions.
Summary by CodeRabbit