ci: pin lychee-action to the commit its version comment names - #70
Merged
Conversation
zizmor's ref-version-mismatch flagged the only mismatched pin here: the SHA and
the version written beside it point at different releases, so the comment
invites a reviewer to trust a version claim that does not hold.
lycheeverse/lychee-action 8646ba3 is v2.8.0, the comment said v2, and v2
has since moved to e747777 (v2.9.0)
It now carries the newest v2 release, commented with the exact version rather
than the floating major. A floating comment is what let this drift: it is
correct only until the next release moves the tag, and then it silently becomes
a lie.
Every other pinned action in this repository was checked the same way and
resolves to the commit its comment names.
Deploying webpage with
|
| Latest commit: |
b62b8ad
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://f3c1edd5.webpage-2vc.pages.dev |
| Branch Preview URL: | https://ci-pin-action-versions.webpage-2vc.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the open
zizmor/ref-version-mismatchalert.links.yml:25lycheeverse/lychee-action# v2e747777# v2.9.0Same major, so no behaviour change is intended — this corrects a comment that
had stopped being true, not the action itself.
The comment is now an exact version rather than a floating major, which is
what let it drift:
# v2is accurate only until the next release moves the tag,and then it quietly becomes a false claim a reviewer has no way to spot.
Every other pinned action in this repository was checked the same way and
resolves to the commit its comment names.
Not addressed here: the five open Dependabot alerts (
vite,esbuild,uuid).All are development-scope and transitive under
vitepress@1.6.4, and clearingthem needs a VitePress 2.x major upgrade — a separate decision.