Pin GitHub Actions and update preview workflow - #312
Conversation
Signed-off-by: AasthathecoderX <bhat.aasthaa@gmail.com>
✅ Deploy Preview for meshery-play canceled.
|
📝 WalkthroughWalkthroughThe pull request pins GitHub Actions to commit SHAs across site, labeling, release, and Slack workflows. Preview comments now indicate when GitHub Pages deployment may still be in progress. ChangesWorkflow updates
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/label-commenter.yml:
- Line 22: Pin the peaceiris/actions-label-commenter action to the exact commit
SHA resolved from v1.10.0 instead of the mutable tag, and retain a # v1.10.0
version comment for auditability. Leave the already-pinned actions/checkout
reference unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 35b7fdd0-ff06-4691-986f-191fc28767af
📒 Files selected for processing (6)
.github/workflows/build-and-deploy-site.yml.github/workflows/deploy-site-preview.yml.github/workflows/label-commenter.yml.github/workflows/labeler.yml.github/workflows/release-drafter.yml.github/workflows/slack.yml
| steps: | ||
| - name: Checkout repo 🛎️ | ||
| uses: actions/checkout@master | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
sha="$(git ls-remote \
https://github.com/peaceiris/actions-label-commenter.git \
'refs/tags/v1.10.0^{}' | awk '{print $1}')"
if [[ -z "$sha" ]]; then
sha="$(git ls-remote \
https://github.com/peaceiris/actions-label-commenter.git \
'refs/tags/v1.10.0' | awk '{print $1}')"
fi
[[ "$sha" =~ ^[0-9a-f]{40}$ ]]
printf 'Use SHA: %s\n' "$sha"
rg -n 'peaceiris/actions-label-commenter@' .github/workflows/label-commenter.ymlRepository: meshery/play
Length of output: 259
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf 'Workflow contents:\n'
cat -n .github.workflow/label-commenter.yml 2>/dev/null || cat -n .github/workflows/label-commenter.yml
printf '\nGit tag object inspection for peaceiris/actions-label-commenter v1.10.0:\n'
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/peaceiris/actions-label-commenter.git "$tmp/clone" >/dev/null 2>&1
git -C "$tmp/clone" rev-parse --verify 'v1.10.0^{commit}' >/tmp/checkout_commit.txt 2>/dev/null || true
git -C "$tmp/clone" rev-parse --verify 'v1.10.0@{commit}' >/tmp/checkout_commit2.txt 2>/dev/null || true
cat /tmp/checkout_commit.txt /tmp/checkout_commit2.txt
rm -rf "$tmp"Repository: meshery/play
Length of output: 996
Pin peaceiris/actions-label-commenter before merging.
This workflow exposes GITHUB_TOKEN to actions/checkout, and actions/checkout is pinned. Pin the remaining mutable action peaceiris/actions-label-commenter@v1.10.0 to an exact commit SHA that resolves from the tag, and keep a version comment such as # v1.10.0 for auditability.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/label-commenter.yml at line 22, Pin the
peaceiris/actions-label-commenter action to the exact commit SHA resolved from
v1.10.0 instead of the mutable tag, and retain a # v1.10.0 version comment for
auditability. Leave the already-pinned actions/checkout reference unchanged.
banana-three-join
left a comment
banana-three-join
left a comment
There was a problem hiding this comment.
Please keep the scope of the audit only to the Build Site Preview and the Site Preview Post-Build workflows. Revert on the changes made to any of the other workflows.
2 participants
Summary
This PR audits and updates the GitHub Actions workflows in accordance with the preview workflow review checklist.
Changes made
pull_request_targetusage:.github/workflows/label-commenter.yml.github/workflows/labeler.ymlwait-for-pages-deploymentis not present in this repository.package.jsondoes not includehugo-extended, so no Hugo CLI/Dart Sass cleanup was required.Actions updated
actions/checkoutactions/labelerpeaceiris/actions-label-commenterrelease-drafter/release-drafterslackapi/slack-github-actionValidation
pull_request_targetworkflows were detected as expected.Summary by CodeRabbit