Skip to content

chore: pin actions/checkout to SHA 0c366fd6a839edf440554fa01a7085ccba70ac98 #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 2 commits into from
Mar 11, 2026
Merged

chore: pin actions/checkout to SHA 0c366fd6a839edf440554fa01a7085ccba70ac98 #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d28ba8f
Initial plan
Copilot Mar 11, 2026
261cf54
chore: update actions/checkout to sha 0c366fd6a839edf440554fa01a7085c…
Copilot Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@

steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v4.2.2

Check warning

Code scanning / zizmor

detects commit SHAs that don't match their version comment tags Warning

detects commit SHAs that don't match their version comment tags
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The inline version comment (# v4.2.2) no longer matches the previously used pinned SHA for v4.2.2 in this repo. Please verify that 0c366fd6… is actually the v4.2.2 commit, or update the comment to the correct version/tag to avoid confusion during future security audits.

Copilot uses AI. Check for mistakes.
with:
persist-credentials: false

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/sync-actions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,14 +192,14 @@ jobs:
INPUT_REF: ${{ inputs.ref }}

- name: Checkout gh-aw-actions (this repository)
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v4.2.2
Copy link

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pinned SHA was changed but the inline comment still says # v4.2.2. Please confirm 0c366fd6… corresponds to v4.2.2, or update the comment to the correct action version/tag so future reviewers don’t assume the wrong release is in use.

This issue also appears on line 202 of the same file.

See below for a potential fix:

        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # actions/checkout pinned commit SHA
        with:
          ref: main
          token: ${{ secrets.GITHUB_TOKEN }}
          path: gh-aw-actions

      - name: Checkout gh-aw at resolved ref (actions/ only)
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # actions/checkout pinned commit SHA

Copilot uses AI. Check for mistakes.
with:
ref: main
token: ${{ secrets.GITHUB_TOKEN }}
path: gh-aw-actions

- name: Checkout gh-aw at resolved ref (actions/ only)
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v4.2.2
with:
repository: github/gh-aw
ref: ${{ steps.resolve-ref.outputs.resolved_ref }}
Expand Down
Loading