-
-
Notifications
You must be signed in to change notification settings - Fork 541
Added commit SHAs instead of versions #2384
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Summary by CodeRabbit
WalkthroughThis pull request updates several GitHub Actions workflow files by replacing version tags with specific commit SHAs. The changes span multiple workflow files, updating actions such as checkout, setup-python, pre-commit, codeql, codecov, cache, upload/download artifact, labeler, sigstore, and create-pull-request. Additionally, the contributing guidelines are enhanced to mandate the use of commit SHAs for any new GitHub Actions. Changes
Assessment against linked issues
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 1
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (5)
.github/workflows/ci-cd.yml
(14 hunks).github/workflows/pre-commit-autoupdate.yml
(3 hunks).github/workflows/prl-labeler.yml
(1 hunks).github/workflows/update-snapshots.yml
(2 hunks)CONTRIBUTING.md
(1 hunks)
🧰 Additional context used
🪛 markdownlint-cli2 (0.17.2)
CONTRIBUTING.md
110-110: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
111-111: Fenced code blocks should be surrounded by blank lines
null
(MD031, blanks-around-fences)
111-111: Fenced code blocks should have a language specified
null
(MD040, fenced-code-language)
117-117: Fenced code blocks should be surrounded by blank lines
null
(MD031, blanks-around-fences)
🔇 Additional comments (25)
.github/workflows/prl-labeler.yml (1)
13-13
: Updated Labeler Action to Commit SHA
Replacing the version tag with commit SHA8558fd74291d67161a8a78ce36a881fa63b766a9
is clear and consistent with our new dependency guidelines..github/workflows/update-snapshots.yml (3)
19-19
: Checkout Action Updated to Commit SHA
The change to use commit SHA11bd71901bbe5b1630ceea73d27597364c9af683
for the checkout step helps stabilize the workflow.
22-22
: Setup Python Action Now Uses a Fixed Commit SHA
Updating to commit SHA8d9ed9ac5c53483de85588cdf95a591a75ab9f55
ensures that the Python environment setup is reproducible.
41-41
: Create Pull Request Action Updated
Locking the version ofpeter-evans/create-pull-request
to commit SHA271a8d0340265f705b14b6d32b9829c1cb33d45e
aligns well with our new dependency update strategy..github/workflows/pre-commit-autoupdate.yml (3)
20-22
: Checkout and Setup-Python Actions Updated
The transitions for bothactions/checkout
(to SHA11bd71901bbe5b1630ceea73d27597364c9af683
) andactions/setup-python
(to SHA8d9ed9ac5c53483de85588cdf95a591a75ab9f55
) ensure that the workflow remains locked to known good states.
32-32
: Cache Action Updated to a Fixed Commit
Using commit SHA5a3ec84eff668545956fd18022155c47e93e2684
for caching enhances reproducibility when working with pre-commit dependencies.
43-43
: Pull Request Creation Action Aligned with Guidelines
The update to use commit SHA271a8d0340265f705b14b6d32b9829c1cb33d45e
keeps this workflow consistent with other files..github/workflows/ci-cd.yml (18)
38-39
: Checkout Action in Pre-commit Job Updated
Using commit SHA11bd71901bbe5b1630ceea73d27597364c9af683
for checking out the repository ensures a fixed code base state across workflow runs.
40-42
: Setup Python Action in Pre-commit Job Updated
The updatedactions/setup-python
with commit SHA8d9ed9ac5c53483de85588cdf95a591a75ab9f55
adds consistency across jobs while ensuring a reproducible Python environment.
47-47
: Pre-commit Action Now Uses a Commit SHA
Locking the version of the pre-commit action (commit SHA2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
) promotes stability in our automated checks.
58-58
: Checkout in CodeQL Job Updated
The CodeQL job now uses the same fixed commit SHA foractions/checkout
, reinforcing consistency across the workflows.
61-61
: CodeQL Initialization Action Updated to Fixed SHA
Using commit SHA70df9def86d22bf0ea4e7f8b956e7b92e7c1ea22
for initializing CodeQL ensures that the analysis is performed under repeatable conditions.
66-66
: CodeQL Analyze Action Locked to Specific Commit
The update to commit SHA for the CodeQL analysis step helps maintain a known, stable state for security scanning.
88-88
: Checkout Action in Test Job Updated
The test job now consistently uses the fixed commit SHA for checking out the repository, which enhances reproducibility.
92-92
: Setup Python in Test Job Now Uses a Commit SHA
Updating to commit SHA8d9ed9ac5c53483de85588cdf95a591a75ab9f55
ensures we have a reproducible Python environment during tests.
113-113
: Codecov Upload Action Updated to a Commit SHA
Locking thecodecov/codecov-action
to commit SHA0565863a31f2c772f9f0395002a31e3f06189574
improves the traceability of our coverage reports.
123-123
: Checkout Action in Build Job Updated
Using the fixed commit SHA for checking out in the build job ensures consistency with earlier steps.
126-126
: Setup Python in Build Job Updated
The update to commit SHA for the Python setup in the build job keeps our build environment consistent and reproducible.
178-178
: Checkout Action in Test-Build Job Updated
The fixed commit SHA for repository checkout in the test-build job reinforces consistency with other parts of the CI/CD pipeline.
180-180
: Setup Python in Test-Build Job Updated
Locking the setup Python action to the specified commit SHA ensures that the testing environment remains stable and predictable.
145-145
: Upload Artifact Action in Build Job Updated
Using commit SHAea165f8d65b6e75b540449e92b4886f43607fa02
for uploading artifacts helps lock down the behavior of this step.
277-277
: Sigstore Action Updated to Commit SHA
The update to commit SHAf514d46b907ebcd5bedc05145c03b69c1edd8b46
for the Sigstore action strengthens our security posture by ensuring a known action state.
285-285
: Upload Artifact in Sign-artifacts Job Updated
Using the fixed commit SHA for the upload action in the sign-artifacts job ensures reliable artifact handling.
298-298
: Download Artifact Action in Release Update Job Updated
Locking the download-artifact action to commit SHA95815c38cf2ff2164869cbab79da8d1f422bc89e
promotes consistency for artifact retrieval during GitHub release updates.
303-303
: Second Instance of Download Artifact Action Updated
Ensuring that both usages of the download-artifact action are fixed to commit SHA guarantees uniform behavior when updating GitHub releases.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## dev #2384 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 204 204
Lines 12999 12999
Branches 1861 1861
=========================================
Hits 12999 12999 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
I used following script to check: Script#!/bin/bash
if [ -z "$1" ]; then
echo "Usage: $0 <workflow.yml>"
exit 1
fi
WORKFLOW_FILE="$1"
if [ ! -f "$WORKFLOW_FILE" ]; then
echo "Error: $WORKFLOW_FILE not found!"
exit 1
fi
OUTPUT_FILE="updated_$WORKFLOW_FILE"
> "$OUTPUT_FILE" # Clear the output file
while IFS= read -r line; do
if [[ "$line" =~ uses:\ (.*)@(.*) ]]; then
action="${BASH_REMATCH[1]}"
ref="${BASH_REMATCH[2]}"
if [[ "$action" == *"/"* ]]; then
repo=$(echo "$action" | cut -d'/' -f1,2)
else
repo="$action"
fi
response=$(gh api repos/${repo}/git/ref/tags/$ref 2>&1)
if [[ $? -ne 0 ]]; then
response=$(gh api repos/${repo}/git/refs/heads/${ref} 2>/dev/null)
fi
sha=$(echo "$response" | jq -r '.object.sha' 2>/dev/null)
type=$(echo "$response" | jq -r '.object.type' 2>/dev/null)
if [ "$type" == "tag" ]; then
response=$(gh api repos/${repo}/git/tags/$sha)
sha=$(echo "$response" | jq -r '.object.sha' 2>/dev/null)
type=$(echo "$response" | jq -r '.object.type' 2>/dev/null)
fi
if [ "$type" != "commit" ]; then
echo "Error: no commit info for $action"
sha=""
fi
if [ -n "$sha" ] && [ "$sha" != "null" ]; then
line=$(echo "$line" | sed "s|$ref|$sha|")
echo "Updated line: $line"
else
echo "Error: SHA not found for $action"
fi
fi
echo "$line" >> "$OUTPUT_FILE"
done < "$WORKFLOW_FILE" |
@coderabbitai can you verify the PR migration to SHA commits using either @KJhellico's script or similar code of your own? |
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain@arkid15r I've run a verification script to check if all GitHub Actions in the workflow files have been properly migrated from version tags to commit SHAs. The script examines each workflow file in the The results will show whether the PR has successfully completed the migration as intended for issue #2343. 🏁 Script executed:
Length of output: 54912 The migration is complete and consistent across all workflow files:
This successfully addresses the requirements in issue #2343 for pinning GitHub Actions to specific commit SHAs instead of version tags. Code Analysis ToolsTool Analysis ResultsCodeRabbit ran static analysis tools on your files and found the following: No specific issues were found in your files. You can proceed with your changes. |
Co-authored-by: ~Jhellico <KJhellico@users.noreply.github.com> Signed-off-by: Arkadii Yakovets <2201626+arkid15r@users.noreply.github.com>
Co-authored-by: ~Jhellico <KJhellico@users.noreply.github.com> Signed-off-by: Arkadii Yakovets <2201626+arkid15r@users.noreply.github.com>
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 2
♻️ Duplicate comments (1)
CONTRIBUTING.md (1)
106-123
: 🧹 Nitpick (assertive)Enhance Markdown Formatting in the New GitHub Actions Section
The new "GitHub Actions" section clearly communicates the updated guidelines. For improved markdown compliance and readability, please consider adding blank lines before and after headings if not already present. The fenced code blocks look good with the language specified.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/ci-cd.yml
(14 hunks)CONTRIBUTING.md
(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: arkid15r
PR: vacanza/holidays#2384
File: .github/workflows/ci-cd.yml:66-66
Timestamp: 2025-03-28T18:28:33.584Z
Learning: When replacing GitHub Actions version tags with commit SHAs, always ensure the SHA corresponds to the latest released version of that action, not an arbitrary or outdated commit. Check the GitHub repository releases page to verify the correct SHA.
⏰ Context from checks skipped due to timeout of 300000ms (1)
- GitHub Check: Test build on windows-latest
🔇 Additional comments (3)
.github/workflows/ci-cd.yml (3)
38-47
: Consistent Use of Commit SHA for Checkout and Pre-commit Actions
The pre-commit job correctly uses the specific commit SHA for bothactions/checkout
andactions/setup-python
, as well as for thepre-commit/action
. This consistency supports the overall goal of pinning dependencies to fixed, verifiable commits.
57-69
: Verification Requested: CodeQL Action Commit SHA
The CodeQL job usesgithub/codeql-action/init
andgithub/codeql-action/analyze
with commit SHA1b549b9259bda1cb5ddde3b41741a82a2d15a841
. Please verify that these SHAs correspond to the latest stable release versions for the CodeQL actions to ensure optimal security and functionality.
32-314
: Overall Workflow Consistency and Alignment
Across the CI/CD workflow file, the use of fixed commit SHAs for actions likeactions/checkout
,actions/setup-python
, and others is consistent and in line with the new contributing guidelines. With the exception of the Codecov and PyPI publish actions that need updating, the changes enhance reliability and traceability in the workflow.
Proposed change
Closes: #2343
Added commit SHAs instead of versions in workflow files.
Type of change
holidays
functionality in general)Checklist
make check
, all checks and tests are green