fix(ci): accept rotated pinned checkout digests - #1799
Conversation
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
Pull request overview
This PR updates the release-workflow regression test to tolerate actions/checkout digest rotations while still enforcing an immutable, lowercase 40-hex SHA pin for the provenance recovery checkout step, preventing Renovate digest bumps from breaking CI.
Changes:
- Parameterizes the provenance recovery test to cover a rotated
actions/checkoutdigest scenario. - Replaces an exact
actions/checkout@<sha>equality assertion with a regex check that enforces a 40-character lowercase SHA pin.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Summary
actions/checkoutcommit digests while still requiring an immutable, lowercase 40-character SHA pin.Validation
PYTHONPATH=$PWD:$PWD/packages/modelaudit-picklescan/src PROMPTFOO_DISABLE_TELEMETRY=1 /Users/mdangelo/code/modelaudit/.venv/bin/python -m pytest tests/test_release_workflow.py -q --tb=short— 133 passed.PYTHONPATH=$PWD:$PWD/packages/modelaudit-picklescan/src PROMPTFOO_DISABLE_TELEMETRY=1 /Users/mdangelo/code/modelaudit/.venv/bin/python -m pytest packages/modelaudit-picklescan/tests/test_call_graph_instance_defaults.py -q --tb=short— 4 passed, including the exact failing Nightly botocore case./Users/mdangelo/code/modelaudit/.venv/bin/ruff check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/— passed./Users/mdangelo/code/modelaudit/.venv/bin/ruff format --check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/— 424 files already formatted.PYTHONPATH=$PWD:$PWD/packages/modelaudit-picklescan/src /Users/mdangelo/code/modelaudit/.venv/bin/mypy tests/test_release_workflow.py— passed.mainPython CI is green.CI context
Renovate PR #1797 currently fails all affected Python, Windows, and coverage lanes solely because the release test hard-codes the previous checkout digest. This change keeps the supply-chain pinning requirement and removes that false failure.