ci: pin actions to SHA in 8 broken workflows#2
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: be519d6085
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 |
There was a problem hiding this comment.
If this repo is running with the sha_pinning_required: true policy that this change is meant to satisfy, pinning only checkout still leaves the workflow blocked at startup: GitHub documents that with this setting “all actions must be pinned to a full-length commit SHA” (https://docs.github.com/en/enterprise-cloud@latest/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository), but the next step here still uses rhysd/actionlint@v1.7.11 by tag. The same partial pinning pattern appears in the other edited workflows, so these runs can continue to fail until all uses: actions are SHA-pinned.
Useful? React with 👍 / 👎.
giattijunior
force-pushed
the
ci/sha-pin-checkout-all-workflows
branch
2 times, most recently
from
0d22754 to
629c300
Compare
All 7 workflows in this branch were failing with startup_failure because actions/checkout@v4 (tag-based) is rejected by the repo's sha_pinning_required: true policy combined with the custom allowed_actions allowlist (patterns_allowed: []). Pin checkout to the current v4 commit SHA 34e114876b0b11c390a56381ad16ebd13914f8d5 in all 7 affected files. Affected workflows: - actionlint.yml (Workflow Lint) - ci-image.yml (Build CI Image) - cve-lite.yml - evals-periodic.yml (Periodic Evals) - evals.yml (E2E Evals) - renovate.yml - skill-docs.yml (Skill Docs Freshness) The 8th workflow (skillspector.yml) is untracked in this branch and not modified here. Discovery: debugging dupehound CI in PR #1 (#69176f5) revealed that actions/checkout@v4 alone triggers the rejection. Other actions tagged @v3/@v4/@v5/@v6 do not (they're not used in pull_request trigger contexts where the policy is enforced). Future bumps of the SHA needed as upstream v4 releases. Refs: #1
giattijunior
force-pushed
the
ci/sha-pin-checkout-all-workflows
branch
from
629c300 to
86d3887
Compare
giattijunior
changed the title
1 participant
Summary
Fix the 8 pre-existing workflows in
giattijunior/gstackthat have been silently failing withstartup_failuredue to a policy conflict betweensha_pinning_required: trueandallowed_actions: selected(custom allowlist with empty patterns).The
skillspector.ymlwas previously untracked in the repo; this PR adds it with the same SHA-pinning treatment.Background
Discovered while debugging the
dupehoundworkflow in #1: every workflow in this repo that usedactions/checkout@v4(tag-based) failed at parse time withstartup_failure— no jobs ever ran, no logs produced, 0-second runs. The 7 pre-existing workflows broken by this were:actionlint.yml(Workflow Lint)ci-image.yml(Build CI Image)cve-lite.ymlevals-periodic.yml(Periodic Evals)evals.yml(E2E Evals)renovate.ymlskill-docs.yml(Skill Docs Freshness)skillspector.yml(SkillSpector)Fix
Pin every tag-based
uses:reference to its current commit SHA in all 8 affected files. Actions pinned in this PR:actions/checkout@v4→34e114876b0b11c390a56381ad16ebd13914f8d5actions/setup-node@v4→49933ea5288caeca8642d1e84afbd3f7d6820020actions/setup-python@v4→7f4fc3e22c37d6ff65e88745f38bd3157c663f7cactions/setup-python@v5→a26af69be951a213d495a4c3e4e4022e16d87065actions/upload-artifact@v4→ea165f8d65b6e75b540449e92b4886f43607fa02actions/download-artifact@v4→d3f86a106a0bac45b974a628896c90dbdf5c8093docker/login-action@v3→c94ce9fb468520275223c153574b00df6fe4bcc9docker/build-push-action@v3→1104d471370f9806843c095c1db02b5a90c5f8b6docker/build-push-action@v6→10e90e3645eae34f1e60eeb005ba3a3d33f178e8astral-sh/setup-uv@v6→d0d8abe699bfb85fec6de9f7adb5ae17292296ffoven-sh/setup-bun@v2→0c5077e51419868618aeaa5fe8019c62421857d6rhysd/actionlint@v1.7.11→393031adb9afb225ee52ae2ccd7a5af5525e03e8renovatebot/github-action@v41→7e1c0fa7cfd2c3e91b27cdd87ae09a6a0fafb5f2(v41.0.0)github/codeql-action/upload-sarif@v4→411bbbe57033eedfc1a82d68c01345aa96c737d7The repo enforces
sha_pinning_required: trueagainst all tag-baseduses:references, not justactions/checkout. Fixing only the latter was insufficient; cve-lite workflow (which usessetup-node,codeql-action,upload-artifact) still failed withstartup_failureuntil all of them were pinned.CI status (this PR)
ubicloud-standard-2runner, slower)The two
successresults confirm the fix works. The 4 queued workflows are still expected to succeed once they complete — they use heavier runners (Docker, ubicloud) and take longer to spin up.Out of scope: cve-lite CLI bug discovered
With the workflow now actually running for the first time, it failed with:
The
cve-lite.ymlinvokescve-lite . --fail-on high --sarif --no-open --report ./cve-report— the--sarifand--reportflags are mutually exclusive. This is a pre-existing bug in the workflow (or the cve-lite CLI) that has been hidden by thestartup_failureof the SHA pinning issue. Fixing it requires deciding which output format to use (SARIF for Code Scanning integration or HTML for artifacts) — that's a separate decision and a separate PR.Caveats
Related