Provide pinning for GitHub Actions#182
Conversation
✅ Deploy Preview for detsys-ts-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
📝 WalkthroughWalkthroughThis PR secures GitHub Actions and dependency management across the repository by pinning Actions to specific commit SHAs in CI and automation workflows, reconfiguring Dependabot with weekly update policies and semver thresholds, and enforcing ref-pinning through Zizmor policy. ChangesActions Pinning and Dependency Management Policy
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~4 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 33-35: The labels array under the npm ecosystem's configuration
incorrectly contains "github-actions"; update the labels entry (the labels: list
associated with the npm ecosystem block) to replace "github-actions" with "npm"
so the dependabot config correctly tags npm updates with the npm label.
In @.github/zizmor.yml:
- Around line 1-5: Replace the unpinned usage of
DeterminateSystems/flakehub-cache-action@main in both CI workflows with a commit
SHA pin (same pattern used for DeterminateSystems/determinate-nix-action); find
the desired commit SHA in the DeterminateSystems/flakehub-cache-action
repository (use the full 40-character commit SHA from the commit you want to
track) and update the action references in the two workflow files that currently
reference DeterminateSystems/flakehub-cache-action@main so they read
DeterminateSystems/flakehub-cache-action@<commit-sha>, ensuring both occurrences
are changed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7e4e6c85-f84b-4711-94fa-80f3ae1fb76c
📒 Files selected for processing (4)
.github/dependabot.yml.github/workflows/ci.yml.github/workflows/update-downstream.yml.github/zizmor.yml
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 21-22: Replace the mutable `@main` refs for the DeterminateSystems
actions with immutable 40-character commit SHAs: update the two usages
"DeterminateSystems/determinate-nix-action@main" and
"DeterminateSystems/flakehub-cache-action@main" to use their specific commit
SHAs (full 40-char values) so the workflow runs a pinned, immutable revision;
obtain the appropriate commit SHA for each action from their repository and
substitute it in place of "@main".
In @.github/workflows/update-downstream.yml:
- Around line 67-70: The workflow uses mutable refs for external actions;
replace the two uses lines referencing
DeterminateSystems/determinate-nix-action@main and
DeterminateSystems/flakehub-cache-action@main with immutable commit SHAs: locate
the uses entries for "DeterminateSystems/determinate-nix-action" and
"DeterminateSystems/flakehub-cache-action", find the appropriate commit SHA for
each action (e.g., from their GitHub repo commit history) and substitute `@main`
with @<full-commit-sha> for both entries so the workflow is pinned to specific
commits.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6fdb1f16-e231-46f5-b9d5-a58143e29471
📒 Files selected for processing (3)
.github/dependabot.yml.github/workflows/ci.yml.github/workflows/update-downstream.yml
✅ Files skipped from review due to trivial changes (1)
- .github/dependabot.yml
| - uses: DeterminateSystems/determinate-nix-action@main | ||
| - uses: DeterminateSystems/flakehub-cache-action@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Identify action refs in workflows that are not pinned to 40-char commit SHAs.
rg -nP 'uses:\s*[^@]+@(?!(?:[0-9a-f]{40}\b))\S+' .github/workflowsRepository: DeterminateSystems/detsys-ts
Length of output: 456
Pin DeterminateSystems action refs to commit SHAs instead of @main.
Using @main is mutable and weakens supply-chain security guarantees. Pin to specific 40-character commit SHAs to ensure immutable workflow execution.
Suggested change
- - uses: DeterminateSystems/determinate-nix-action@main
- - uses: DeterminateSystems/flakehub-cache-action@main
+ - uses: DeterminateSystems/determinate-nix-action@<commit-sha>
+ - uses: DeterminateSystems/flakehub-cache-action@<commit-sha>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 21 - 22, Replace the mutable `@main`
refs for the DeterminateSystems actions with immutable 40-character commit SHAs:
update the two usages "DeterminateSystems/determinate-nix-action@main" and
"DeterminateSystems/flakehub-cache-action@main" to use their specific commit
SHAs (full 40-char values) so the workflow runs a pinned, immutable revision;
obtain the appropriate commit SHA for each action from their repository and
substitute it in place of "@main".
There was a problem hiding this comment.
My zizmor config explicitly says that this is okay
There was a problem hiding this comment.
@lucperkins, you're right — I can see from the .github/zizmor.yml changes in this PR that DeterminateSystems/* is explicitly listed under policies with the ref-pin exception. That's a deliberate, documented policy decision. I'll disregard this in future reviews.
ʕ •ᴥ•ʔ
✏️ Learnings added
Learnt from: lucperkins
Repo: DeterminateSystems/detsys-ts PR: 182
File: .github/workflows/ci.yml:21-22
Timestamp: 2026-05-12T18:06:37.874Z
Learning: In the DeterminateSystems/detsys-ts repository, `DeterminateSystems/*` GitHub Actions (e.g., `DeterminateSystems/determinate-nix-actionmain`, `DeterminateSystems/flakehub-cache-actionmain`) are intentionally allowed to use mutable `main` refs rather than pinned commit SHAs. This exception is explicitly declared in `.github/zizmor.yml` under `policies` with `ref-pin` for the `DeterminateSystems/*` namespace, and `DeterminateSystems/*` is also excluded from Dependabot updates in `.github/dependabot.yml`. Do not flag these as unpinned action refs.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
1 participant
This pins our GitHub Actions and provides automated updates. This PR also specifies cooldown for npm dependencies.
Summary by CodeRabbit