fix: pin GitHub Actions to commit SHAs (INT-326)#97
Conversation
📝 WalkthroughWalkthroughThis pull request updates multiple GitHub Actions workflow files across the repository. The changes include pinning newer versions of external action dependencies ( Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes The majority of changes involve straightforward version pinning updates across multiple files (repetitive pattern), but the removal of the Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/test.yaml:
- Around line 24-28: The workflow currently installs Aqua but never checks out
code, doesn't run tests, and pins the installer by tag; add an actions/checkout
step (use actions/checkout) immediately before the Aqua installer step so
aqua.yaml is available, replace the aqua-installer tag
(aquaproj/aqua-installer@v4.0.4) with a specific commit SHA to pin the action,
and add a run step that uses the matrix variable (use matrix.tf) to execute the
test command (e.g., run: ${{ matrix.tf }} test) so the defined matrix actually
runs tests.
In @.github/workflows/tester.yaml:
- Around line 1-19: The workflow is incomplete: the job named "deploy" only
installs the Aqua action (aquaproj/aqua-installer@v4.0.4) and lacks a checkout
step, any test steps, and uses a tag instead of a commit SHA; fix by adding a
workspace checkout (actions/checkout) before the "Install Aqua" step, rename the
job from "deploy" to something like "test" to match intent, add concrete test
steps that consume aqua.yaml (lint/build/test commands) after installing Aqua,
or remove the file entirely if it's redundant with test.yaml, and pin the
aquaproj/aqua-installer action to a specific commit SHA rather than the tag to
improve security and reproducibility.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 95f2b356-22f8-4fde-ac93-ef34a27e712e
📒 Files selected for processing (4)
.github/workflows/lint.yaml.github/workflows/test.yaml.github/workflows/tester.yaml.github/workflows/trunk-upgrade.yaml
|
|
||
| - name: Install Aqua | ||
| uses: aquaproj/aqua-installer@v4.0.4 | ||
| with: | ||
| tf_type: ${{ matrix.tf }} | ||
| aws_role_arn: ${{ vars.TF_TEST_AWS_ROLE_ARN }} | ||
| github_token: ${{ secrets.GITHUB_TOKEN }} | ||
| aqua_version: v2.48.1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Get the commit SHA for aquaproj/aqua-installer v4.0.4
gh api repos/aquaproj/aqua-installer/git/refs/tags/v4.0.4 --jq '.object.sha'Repository: masterpointio/terraform-aws-tailscale
Length of output: 241
🏁 Script executed:
cat -n .github/workflows/test.yamlRepository: masterpointio/terraform-aws-tailscale
Length of output: 724
🏁 Script executed:
wc -l .github/workflows/test.yamlRepository: masterpointio/terraform-aws-tailscale
Length of output: 111
Workflow is incomplete and non-functional.
The workflow installs Aqua but lacks two critical steps:
- No
actions/checkout– Without checking out the repository, Aqua cannot accessaqua.yamlto install tools - No test execution – The matrix
tf: [tofu, terraform]is defined but never used; there's no step to runterraform testortofu test
Additionally, aquaproj/aqua-installer@v4.0.4 uses a version tag rather than a commit SHA.
Add a actions/checkout step before Aqua, pin the action to its commit SHA, and add a step to execute the test command using the matrix variable (e.g., run: ${{ matrix.tf }} test).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/test.yaml around lines 24 - 28, The workflow currently
installs Aqua but never checks out code, doesn't run tests, and pins the
installer by tag; add an actions/checkout step (use actions/checkout)
immediately before the Aqua installer step so aqua.yaml is available, replace
the aqua-installer tag (aquaproj/aqua-installer@v4.0.4) with a specific commit
SHA to pin the action, and add a run step that uses the matrix variable (use
matrix.tf) to execute the test command (e.g., run: ${{ matrix.tf }} test) so the
defined matrix actually runs tests.
| name: Test CI/CD | ||
|
|
||
| on: | ||
| pull_request: | ||
|
|
||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
|
|
||
| jobs: | ||
| deploy: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
|
|
||
| - name: Install Aqua | ||
| uses: aquaproj/aqua-installer@v4.0.4 | ||
| with: | ||
| aqua_version: v2.48.1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if there are other test workflows that might make this redundant
fd -e yaml -e yml . .github/workflows --exec basename {} | sortRepository: masterpointio/terraform-aws-tailscale
Length of output: 151
🏁 Script executed:
cat -n .github/workflows/test.yamlRepository: masterpointio/terraform-aws-tailscale
Length of output: 724
🏁 Script executed:
cat -n .github/workflows/tester.yamlRepository: masterpointio/terraform-aws-tailscale
Length of output: 475
🏁 Script executed:
wc -l .github/workflows/tester.yamlRepository: masterpointio/terraform-aws-tailscale
Length of output: 113
🏁 Script executed:
wc -l .github/workflows/test.yamlRepository: masterpointio/terraform-aws-tailscale
Length of output: 111
This workflow is incomplete and should not be merged as-is.
The tester.yaml file appears to be unfinished test scaffolding. It's missing several critical elements:
- No checkout step – The workflow can't access
aqua.yamlor any repository files - No test implementation – Only installs Aqua with no actual tests following
- Misleading job name – Job is named
deploybut the workflow is "Test CI/CD"
Before merging, either complete this workflow with the necessary checkout step and test logic, or remove it if it's meant to be replaced by test.yaml.
Additionally, consider pinning the Aqua installer action to a commit SHA rather than a tag for better security and reproducibility.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/tester.yaml around lines 1 - 19, The workflow is
incomplete: the job named "deploy" only installs the Aqua action
(aquaproj/aqua-installer@v4.0.4) and lacks a checkout step, any test steps, and
uses a tag instead of a commit SHA; fix by adding a workspace checkout
(actions/checkout) before the "Install Aqua" step, rename the job from "deploy"
to something like "test" to match intent, add concrete test steps that consume
aqua.yaml (lint/build/test commands) after installing Aqua, or remove the file
entirely if it's redundant with test.yaml, and pin the aquaproj/aqua-installer
action to a specific commit SHA rather than the tag to improve security and
reproducibility.
1 participant
Info
uses:references in GitHub Actions workflows to full commit SHAs.References
Summary by CodeRabbit