Repository navigation
Harden CI workflows with pinned actions and scoped checkout credentials - #423
Merged
Merged
Conversation
|
Warning Review limit reachedNext included review available in 51 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
juanmaguitar
added a commit
that referenced
this pull request
Sep 10, 2026
## Why An advisory bot check can succeed without completing a review. Review evidence needs to show who reviewed which revision, whether the pass actually completed, and what changed after it. ## What changes Document the required review evidence in the shared review standard and add a matching record to the default pull-request template. The record distinguishes completed, partial, and omitted reviews; names the reviewed head and base; and keeps the comparison after a later push visible. ## How to test this **Starting state:** This branch, with the review standard and pull-request template open. 1. Open `.github/instructions/code-review.instructions.md` and read **How to report**. - Expected: it requires a reviewer, reviewed head/base SHAs, completion status, evidence, and a re-check after subsequent changes. 2. Open `.github/pull_request_template.md` and expand **Review outcome**. - Expected: the template has fields for all of that evidence, including **Changes since review**. 3. Consider a skipped bot review, a partial review, and a later push after a completed review. - Expected: each can be recorded without representing it as zero findings or erasing the original-to-current SHA comparison. **What must not have happened:** This must not imply that advisory bot availability is a completed review, or create a new required CI check or merge permission. Platforms: any — this changes repository Markdown only. ## Risks and limitations This is a reporting/process guardrail, not automated enforcement. It depends on authors and reviewers completing the record accurately. ## Related Follow-up to #423. --- <details> <summary>Design decisions and alternatives considered</summary> The standard remains the single source of truth; the template records the same evidence rather than duplicating policy. A dedicated **Changes since review** field retains the old-to-new SHA comparison when a push makes an earlier review stale. </details> <details> <summary>Review outcome (required — see AGENTS.md)</summary> 0 [fix here] · 0 [follow-up] - **Review:** completed — `/root/fresh_review_after_rebase` (fresh agent context); `52d08e8bf82dced214070172a678eab19ddc411a` / `fd834881559ed172f9fcfb0e53963e30adaa30a2`; local independent judgement review with no findings; `npm run lint` and `npm test` passed (1,258 tests); no uncommitted scope. - **Since review:** `cf1cd7d3f11fdf37f71a1400c180f531752d8325` → `52d08e8bf82dced214070172a678eab19ddc411a` checked; re-review completed with no findings. </details> <details> <summary>Implementation notes</summary> No application code or dependencies changed. </details> <details> <summary>Screenshots or recording</summary> No user-visible application surface changed. </details>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The lint, unit and E2E workflows use mutable action tags, so their executed code can change without a repository diff. Unit and E2E jobs also retain checkout authentication in Git configuration while installing and testing code, although they do not need authenticated Git operations after checkout.
What changes
Pin checkout, setup-node and upload-artifact to the full commits currently referenced by their v4 tags, with version comments for readability. Disable checkout credential persistence in the unit job and both E2E jobs; lint already disables it. This changes three workflows without upgrading action major versions or changing their triggers, permissions, matrices or test commands.
How to test this
Starting state: This PR is ready for review and GitHub Actions has started runs for its latest revision. There is no application UI change to exercise. Platforms: Ubuntu for lint, macOS and Windows for unit tests and E2E.
persist-credentials: false. Compare the pins with the upstream version tags listed in the implementation notes below.What must not have happened: No jobs or platforms should disappear, the action major versions should not change, and no extra permissions or credentials should be needed to make the jobs pass. Application files and lockfiles should not change.
Local checks:
npm run lint,npm testandgit diff --check origin/trunk...HEAD. These pass, but local tests do not reproduce GitHub's checkout authentication; the Actions runs above are needed for that validation. Failure-only artifact upload remains configured; its execution is not demonstrated by a green run.Risks and limitations
An unnoticed dependency on authenticated Git operations after checkout would now fail in CI. The pins match the existing v4 tags, reducing version-change risk, but future action updates must update the SHA explicitly. Remote CI validation is pending when this PR is opened.
Related
Repository guardrail audit: action pinning and checkout credential persistence. No issue is closed by this PR.
Review outcome (required — see AGENTS.md)
0 [fix here] / 0 [follow-up]. A fresh-context reviewer applied .github/instructions/code-review.instructions.md across all five dimensions and found no issues. The reviewer independently verified the upstream SHA tags and checked the workflows and invoked scripts for reliance on persisted checkout credentials. No findings needed fixing or deferring within this PR's scope.
Deterministic validation passed: repo-wide ESLint; all 1,254 tests with zero failures or skips; YAML parsing and a structured comparison confirming only action pins and checkout credential settings changed; whitespace validation with git diff --check. Actionlint was not available locally. No application tests were added for this configuration-only change.
Implementation notes
Resolved directly from upstream refs with git ls-remote: