fix: pin dependencies - #170
Merged
Merged
Conversation
Pin workflow actions, build images, and benchstat to immutable hashes. Give the dynamic Docker target a stable default so internal stages are recognized as pinned.
BenchstatBase: 4 minor regression(s) (all within 5% threshold)
1 improvement(s)
Full benchstat output |
WalkthroughThe pull request replaces mutable GitHub Action, ChangesBuild Input Pinning
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/lint.yml (1)
16-24: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winPin the
golangci-lintversion.The action is pinned, but
version: lateststill selects a moving tool version. Replace it with an exact approved version.Proposed fix
with: - version: latest + version: vX.Y.Z🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/lint.yml around lines 16 - 24, Replace the moving `version: latest` setting in the `golangci-lint` action configuration with the exact approved golangci-lint version, while preserving the existing action pin and arguments.
🧹 Nitpick comments (1)
Dockerfile.integration (1)
1-1: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winUse a direct digest reference for the shared Go base image.
golang:1.26-alpineis mutable and can resolve to another Go 1.26.x patch. Since this digest refers to thegolang:1.26.5-alpinemulti-platform image and is already pinned, reference the digest directly in both Dockerfiles sogolang:1.26-alpinechanges do not affect these builds.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile.integration` at line 1, Replace the mutable golang:1.26-alpine reference with the specified direct digest reference in Dockerfile.integration at lines 1-1 and Dockerfile at lines 3-3, preserving the existing pinned digest so both builds use the golang:1.26.5-alpine image.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/benchmark.yml:
- Around line 22-25: Update the actions/checkout step in the benchmark workflow
to disable GitHub credential persistence by setting its persist-credentials
option to false, while preserving the existing full-history fetch configuration.
---
Outside diff comments:
In @.github/workflows/lint.yml:
- Around line 16-24: Replace the moving `version: latest` setting in the
`golangci-lint` action configuration with the exact approved golangci-lint
version, while preserving the existing action pin and arguments.
---
Nitpick comments:
In `@Dockerfile.integration`:
- Line 1: Replace the mutable golang:1.26-alpine reference with the specified
direct digest reference in Dockerfile.integration at lines 1-1 and Dockerfile at
lines 3-3, preserving the existing pinned digest so both builds use the
golang:1.26.5-alpine image.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: cccd4168-1a8f-46ab-ac8d-db8c199578d4
📒 Files selected for processing (6)
.github/workflows/benchmark.yml.github/workflows/lint.yml.github/workflows/release.yml.github/workflows/test.ymlDockerfileDockerfile.integration
Comment on lines
22
to
25
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not persist the GitHub token in the checkout.
Later steps use local Git operations and execute checked-out code. actions/checkout otherwise stores GITHUB_TOKEN in .git/config. Disable credential persistence to reduce token exposure.
Proposed fix
- name: Checkout code
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
+ persist-credentials: false
fetch-depth: 0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Checkout code | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 22-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/benchmark.yml around lines 22 - 25, Update the
actions/checkout step in the benchmark workflow to disable GitHub credential
persistence by setting its persist-credentials option to false, while preserving
the existing full-history fetch configuration.
Source: Linters/SAST tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit