Repository navigation
fix(ci): pin actions to commits and move them off v4 - #4
Merged
Merged
Conversation
Every third-party action is now pinned to a commit SHA with the release in a trailing comment, so a repointed tag cannot swap the code under the build. - actions/checkout v4 -> v7.0.1 - actions/upload-artifact v4 -> v7.0.2 - actions/download-artifact v4 -> v8.0.2 (hash mismatch now fails the run) - Swatinem/rust-cache v2 -> v2.9.3 - dtolnay/rust-toolchain: pinned to a master commit, toolchain named explicitly All of them run on Node 24 now, which clears the checkout/upload-artifact Node 20 deprecation annotations.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You merged #3 while this was still being written, so it rides on the same branch and only this commit is new.
Every third-party action is now pinned to a commit SHA with the release in a trailing comment. A tag is a mutable pointer, so
@v7is a supply-chain hole as well as a silent upgrade, and the comment is what keeps the SHA readable.toolchain: stablenamed explicitlyNotes:
dtolnay/rust-toolchainpublishes no release tags, so the pin is a commit onmasterplus an explicittoolchain:input (the branch refs are what select the toolchain, and a SHA does not).download-artifact@v8now fails the run on a digest mismatch instead of warning. Both artifacts it reads are zipped byupload-artifact@v7, so the no-unzip-non-zipped-files change does not apply.macos-15stays as merged in fix(ci): macOS 15 runner and SHA-pinned actions #3.The PR
checkjob exercises the checkout, toolchain and cache pins for real; the artifact pair is only proven by a run onmain.