chore(ci): pin action refs to verified SHAs - #10
Conversation
Rewrites mutable version tags to 40-char SHAs with a trailing version comment. A tag can be silently repointed by its owner; a SHA cannot. Every SHA was resolved THROUGH the tag object and re-verified against the commits endpoint before being written — not copied by hand. An annotated tag's ref sha is the tag OBJECT, not the commit, and getting that wrong is how df-cicd ended up with four pins to commits that never existed, silently killing infra-dns's IaC gate for six consecutive runs (df-cicd#18). Any ref that could not be confirmed was left untouched. Branch refs (@main/@master) are deliberately NOT rewritten: choosing which release to adopt is a decision, not a mechanical substitution. Against the org baseline this takes the repo from 15 advisory finding(s) to 2 — fully clean, with 0 required. Generated by df-cicd/baseline/pin_actions.py. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PRVqMsvZcbfRnV6KUTMF2Q
|
Warning Review limit reached
Next review available in: 1 minute Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
🛡️ Sentinel PR review
|
![sentinel-by-digital-frontier[bot]](https://avatars.githubusercontent.com/u/275657175?s=60&v=4){kind=small}
Rewrites mutable version tags to 40-char SHAs with a trailing version comment. A tag can be silently repointed by its owner; a SHA cannot.
How the SHAs were obtained matters
Each was resolved through the tag object, then re-verified against the commits endpoint before being written.
Any ref that couldn't be confirmed was left untouched: an unverifiable SHA is worse than the tag it replaces, because a tag at least resolves.
Branch refs (
@main/@master) are deliberately not rewritten — choosing which release to adopt is a decision, not a mechanical substitution.Result
Against the org baseline: 15 advisory → 2, with 0 required. This repo becomes fully clean.
Every workflow was re-parsed after the rewrite. Generated by
df-cicd/baseline/pin_actions.py(df-cicd#34); the reference application is just-akash#104.🤖 Generated with Claude Code
https://claude.ai/code/session_01PRVqMsvZcbfRnV6KUTMF2Q