chore(deps): pin GitHub Actions to commit SHAs so cooldown applies#461
Merged
Conversation
D30 gates dependency bumps behind a 7-day cooldown, but for GitHub Actions that gate was inert: every `uses:` referenced a floating major tag, which is a mutable pointer GitHub re-resolves at CI runtime. Dependabot only opens a PR when it sees a new version, so a re-pointed or compromised tag reached CI on the next run with no PR, no review, and no delay. Pin all 37 third-party refs to 40-char commit SHAs with a `# vX.Y.Z` comment (the 3 local `./.github/actions/*` path refs stay as-is). Dependabot now maintains the SHA + comment, so the existing cooldown gates every Actions bump like it does cargo/npm. Pins are all >=7 days old, so adoption itself respects the window; shared actions reuse overfolder's exact pins to keep the repos in lockstep. Mirrors overfolder's 2026-07-13 decision. Also adds the `open-pull-requests-limit: 10` the github-actions block was missing. Obsoletes #457 (install-action v2 -> v2.82.9, tag-to-tag): this lands the same version as an immutable SHA. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UpS2MLgHnfp9bMP1uR127X
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
D30 gates dependency bumps behind a 7-day
cooldown— but for GitHub Actions that gate was inert.Every
uses:in this repo referenced a floating major tag (actions/checkout@v7,dtolnay/rust-toolchain@stable, …). A major tag is a mutable pointer GitHub re-resolves at CI runtime, and Dependabot only opens a PR when it sees a new version — it proposes nothing when the tag itself moves underneath us. So a re-pointed or compromised tag reached CI on the next run with no PR, no review, and no 7-day delay: precisely the window D30 exists to close.Mirrors overfolder's 2026-07-13 decision. Recorded here as D31.
What
ci.yml,release.yml,release-please.ymlto 40-char SHAs with a# vX.Y.Zcomment. Dependabot maintains the SHA + comment, socooldownnow gates every Actions bump like cargo/npm. The 3 local./.github/actions/seed-ort-cachepath refs are unpinnable and left as-is.dependabot.yml: added theopen-pull-requests-limit: 10thegithub-actionsblock was missing (cargo/npm already had it), plus the rationale comment.Every pin is ≥7 days old, so adoption itself respects the cooldown window. Shared actions reuse overfolder's exact pins to keep the repos in lockstep.
actions/checkout9c091bb2# v7.0.0actions/setup-node48b55a01# v6.4.0actions/upload-artifact043fb46d# v7.0.1actions/download-artifact3e5f45b2# v8.0.1dtolnay/rust-toolchain4be7066a# stable branchSwatinem/rust-cachec1937114# v2.9.1taiki-e/install-action4684b840# v2.82.9dorny/paths-filter7b450fff# v4.0.2codecov/codecov-actionfb8b3582# v7.0.0rui314/setup-mold9c9c13bf# v1 (mutable tag)opentofu/setup-opentofua1320f89# v2.0.2googleapis/release-please-action45996ed1# v5.0.0softprops/action-gh-release718ea10b# v3.0.1Two versions are deliberately not latest, held by the 7-day rule — Dependabot will propose them once they age in:
action-gh-release→ v3.0.1, not v3.0.2 (published 3 days ago)install-action→ v2.82.9, not v2.83.2 (published 4 days ago)Obsoletes #457
#457 bumps
taiki-e/install-actionv2 → v2.82.9 — tag-to-tag, still mutable. This PR lands the same version as an immutable SHA, so #457 is redundant. Closing it once this merges (overfolder did the same with its #491).New tech debt
dtolnay/rust-toolchain@stableandrui314/setup-mold@v1pin branches, not release tags (setup-mold publishes no semver releases at all). Dependabot tracks tags/releases, so it won't bump either. Runtime behavior is unaffected — rustup still resolvesstable, mold still installs — only the action code is frozen. Ideal fix is a periodic manual re-pin; logged in TECH_DEBT.md.Verification
uses:outside./.github/actions/is a 40-char SHA (37 pinned + 3 local).gh api, and every# vX.Y.Zcomment was checked to match the tag's actual commit (annotated tags dereferenced). A wrong comment is worse than none — Dependabot reads it.dependabot.ymlconfirmed to have limit + cooldown on all three ecosystems.release.yml/release-please.ymldon't run on PRs, soaction-gh-release,release-please-action, and the artifact up/downloads are verified by inspection only (SHA resolution + tag match), not by execution.No CI enforcement step (
zizmor/pinact) — overfolder enforces by convention + Dependabot maintenance only; adding a linter is a separate decision.🤖 Generated with Claude Code
https://claude.ai/code/session_01UpS2MLgHnfp9bMP1uR127X