ci: update SHA-pinned GitHub Actions via ratchet - #47
Closed
cursor[bot] wants to merge 1 commit into
Closed
Conversation
Refresh pinned SHAs to latest within existing ratchet version constraints: - actions/checkout: v7.0.0 -> v7.0.1 - aws-actions/configure-aws-credentials: v6.2.2 -> v6.2.3 - jdx/mise-action: v4.2.1 -> v4.2.3 Co-authored-by: Nick Pellegrino <nickpell@users.noreply.github.com>
10 tasks
nickpell
added a commit
that referenced
this pull request
Aug 5, 2026
## Summary - Weekly automated refresh of SHA-pinned GitHub Actions via `mise run //:ratchet:update`. Bumps pinned commit SHAs to the latest release **within** existing major-version constraints (`# ratchet:owner/action@vN` comments unchanged — no major upgrades). - Supersedes the prior week's draft `#47` (now closed): same two bumps plus a newer `jdx/mise-action` release (v4.2.1 → v4.2.4). - Pins: `actions/checkout` v7.0.0→v7.0.1, `aws-actions/configure-aws-credentials` v6.2.2→v6.2.3, `jdx/mise-action` v4.2.1→v4.2.4. Patch-level only; low risk; rollback is a trivial revert. ## Pre-merge checklist - [x] Build / CI passes (Go `test` + `lint`, Ratchet Lint — all green) - [x] Lint passes (Go lint + Ratchet Lint) - [x] Tests pass (`mise run //:test` / Go workflow) - [x] Diff contains no unintended changes (SHA pins only; `@vN` constraints unchanged; verified SHAs map to stated release tags) - [x] Docs / config updated if behavior or interface changed — N/A (CI pin refresh only) - [x] Cross-repo dependencies noted and ordered — N/A (openauction-only; supersedes closed #47) ## Post-deploy/apply verification - [ ] Deploy or apply completed successfully — N/A for merge itself; next workflow runs on `main` exercise the new pins - [ ] Target resource / workload reached the intended state — confirm subsequent Go / Ratchet / docker / eif-build workflow runs on `main` succeed with the new action SHAs - [ ] Dependent service(s) healthy — N/A (no runtime deploy) - [ ] Metrics / synthetics green after the change — N/A (CI tooling only) <div><a href="https://cursor.com/agents/bc-b23ff061-5ae6-4023-b8d4-4f44d68aa720?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/automations/65e8572f-8209-11f1-a7d1-d6b4613131ce"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/view-automation-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/view-automation-light.png"><img alt="View Automation" width="141" height="28" src="https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Nick Pellegrino <nickpell@users.noreply.github.com>
![https://cursor.com/assets/images/open-in-web-dark.png"><source](https://cursor.com/assets/images/open-in-web-dark.png"><source){kind=link}
![https://cursor.com/assets/images/open-in-web-light.png"><img](https://cursor.com/assets/images/open-in-web-light.png"><img){kind=link}
![https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a](https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a){kind=link}
![https://cursor.com/assets/images/view-automation-dark.png"><source](https://cursor.com/assets/images/view-automation-dark.png"><source){kind=link}
![https://cursor.com/assets/images/view-automation-light.png"><img](https://cursor.com/assets/images/view-automation-light.png"><img){kind=link}
![https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div](https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div){kind=link}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ran
mise run //:ratchet:updateto refresh the SHA pins of our GitHub Actions to the latest commits within their existing ratchet version constraints. No version constraints (# ratchet:owner/action@vN) were changed — these are patch-level SHA bumps only.Three actions were updated across
go.yml,docker.yml,eif-build.yml, andratchet.yml:actions/checkout@v79c091bb)3d3c42e)aws-actions/configure-aws-credentials@v6517a711)e6de054)jdx/mise-action@v4dad1bfd)9e7f763)What changed in each update
actions/checkoutv7.0.0 → v7.0.1(compare)
git config --unset(hardening).aws-actions/configure-aws-credentialsv6.2.2 → v6.2.3(compare)
PackedPolicyTooLargedetection in STS session tags — clearer error surfacing when session tags exceed the packed-policy size limit.jdx/mise-actionv4.2.1 → v4.2.3(compare)
tarsupports Zstd before selecting the.tar.zstmise archive; fall back to.tar.gzon older runners (e.g. RHEL8-compatible with GNU tar 1.30). README default corrected tomise-v1.GITHUB_ENV; v4.2.3 re-forwards only the mise-added PATH prefix throughGITHUB_PATH(without snapshotting the runner's full PATH). Adds anexport_pathinput (defaulttrue).Risk assessment
Overall: Low. All three are patch releases that stay within the pinned major, and every SHA was verified to resolve to the stated release tag via the GitHub API.
actions/checkout(Low): Bug fixes and git-config hardening only; no interface changes. Our usage is basic checkout (withref/tokeninputs), unaffected by the changed edge cases.aws-actions/configure-aws-credentials(Low): Both fixes are non-breaking. The STSPackedPolicyTooLargeimprovement is only error-reporting; our OIDC role-assumption usage (no session tags) is unaffected.jdx/mise-action(Low, net improvement): The Zstd fallback only affects older runners (we useubuntu-latest). The PATH-propagation restoration is beneficial — it reverses a regression from v4.2.1. Our workflows invoke tools viamise run //:...(which resolves its own shims), so the previous PATH gap wasn't affecting us, and restoring it composes cleanly. Defaultexport_path: truepreserves prior intent.No secrets, permissions, triggers, or workflow logic were modified.
Verification checklist
mise run //:ratchet:updateproduced only SHA changes; version constraints unchanged.mise run //:ratchet:lintpasses (all external refs remain pinned).mise run //:ratchet:pinis idempotent — no additional diff (matches the CIgit diff --exit-codegate).mise run //:test(go test ./...) passes.gh api .../git/refs/tagsto map to the release tag shown above.@vN) changes are intended in this update-only PR.