Skip to content

ci: align Julia setup and cache action pins - #33

Merged
hyperpolymath merged 3 commits into
mainfrom
chore/julia-action-pins-20260809
Aug 9, 2026
Merged

ci: align Julia setup and cache action pins#33
hyperpolymath merged 3 commits into
mainfrom
chore/julia-action-pins-20260809

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Updates julia-actions/setup-julia to v3.0.2 and julia-actions/cache to v3.1.0. Workflow-only maintenance; no runtime code changes.

Comment thread .github/workflows/release.yml
@gitar-bot

gitar-bot Bot commented Aug 9, 2026

Copy link
Copy Markdown

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 1 resolved / 1 findings

Aligns Julia setup and cache action pins in the CI workflow, but the updated SHAs must be verified against their claimed v3 release tags to ensure integrity.

✅ 1 resolved
Security: Verify pinned SHAs actually match claimed v3 tags

📄 .github/workflows/release.yml:31 📄 .github/workflows/release.yml:35 📄 .github/workflows/release.yml:61 📄 .github/workflows/ci.yml:17
The updated pins point setup-julia to fa02766…e6a32 (# v3.0.2) and cache to a45e8fa…e9b38 (# v3.1.0), but automated verification could not confirm these commit SHAs correspond to the tags noted in the comments. SHA-pinning is a supply-chain safeguard, so a comment/SHA mismatch (or a SHA that doesn't belong to the intended release) defeats the purpose and could pin an unintended commit. Confirm each SHA resolves to its labeled tag (e.g. git ls-remote https://github.com/julia-actions/setup-julia refs/tags/v3.0.2) before merging.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact
gitar display:verbose         

Important

Your trial ends in 1 day — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

Was this helpful? React with 👍 / 👎 | Gitar

gitar-bot[bot]

This comment was marked as resolved.

@hyperpolymath

Copy link
Copy Markdown
Owner Author

Verified the SHA-pinned action tags requested by review: julia-actions/setup-julia v3.0.2 resolves to fa02766e078afaaf09b14210362cee14137e6a32, and julia-actions/cache v3.1.0 resolves to a45e8fa8be21c18a06b7177052533149e61e9b38. Both were checked with git ls-remote against the upstream tag refs.

@gitar-bot
gitar-bot Bot dismissed their stale review August 9, 2026 09:42

✅ All code review findings resolved.

Configure merge blocking

Remove the obsolete Julia 1.9 CI matrix entry. Julia 1.10 and 1.11
remain required supported versions; nightly remains where it was already
part of the matrix.
The CI test uses the documented ExnovationItem API. Export the type from
the package module so it is available after using Exnovation.
@hyperpolymath
hyperpolymath merged commit 30cc188 into main Aug 9, 2026
22 of 27 checks passed
@hyperpolymath
hyperpolymath deleted the chore/julia-action-pins-20260809 branch August 9, 2026 11:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant