Skip to content

ci: add integration test workflow #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
superdav42 merged 1 commit into from
Mar 26, 2026
Merged

ci: add integration test workflow #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
name: CI

on:
push:
branches: [main]
pull_request:
branches: ["**"]

jobs:
integration-test:
uses: Ultimate-Multisite/ultimate-multisite/.github/workflows/addon-integration-test.yml@main
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Pin the reusable workflow to a specific commit SHA or version tag.

Using @main for the external workflow reference means this CI will always use the latest version from the main branch, which creates security and stability risks:

  • Upstream changes can break your CI without warning
  • Builds become non-reproducible
  • If the upstream repository is compromised, malicious workflow changes could affect this addon

Best practice is to pin to a specific commit SHA (e.g., @a1b2c3d) or semantic version tag (e.g., @v1.2.3) for stability and security.

🔒 Proposed fix to pin to a commit SHA 
-    uses: Ultimate-Multisite/ultimate-multisite/.github/workflows/addon-integration-test.yml@main
+    uses: Ultimate-Multisite/ultimate-multisite/.github/workflows/addon-integration-test.yml@<commit-sha>

Replace <commit-sha> with the full commit SHA of the version you want to use.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml at line 11, Replace the floating reference to the
upstream reusable workflow by pinning the uses: entry (uses:
Ultimate-Multisite/ultimate-multisite/.github/workflows/addon-integration-test.yml@main)
to a specific commit SHA or a semantic version tag; update that string to use
@<commit-sha> or `@vX.Y.Z` so CI consumes a fixed, auditable version instead of
`@main`.

with:
addon-slug: ultimate-multisite-mailster
secrets: inherit
Loading