Repository navigation
ci: pin third-party actions by commit, pin the lint tool versions - #32
Merged
Merged
Conversation
A moved tag on a third-party action would run new code with this job's token, and golangci-lint (gofumpt in the orchestrator E2E job) installed whatever release was newest, so a new release could fail unrelated pull requests. Each third-party action now names its commit with the release as a comment; golangci-lint is v2.14.0 and gofumpt v0.12.0, the versions the last green runs used. GitHub's own actions/* stay on tags. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
From the CI review (LC-204, "tools are not pinned").
docker/*,golangci/golangci-lint-action,pnpm/action-setup,foundry-rs/foundry-toolchain,dorny/paths-filter, as present in this repo). Each SHA is what the major tag pointed at on 2026-10-19. GitHub's ownactions/*stay on tags.golangci-lint-actionruns, it getsversion: v2.14.0; without it the action installs the newest release (v2.15.0 since 2026-10-16). In the orchestrator's E2E job,gofumpt@latest/golangci-lint@latestbecomev0.12.0/v2.14.0, the versions of the last green runs on 2026-10-13.Workflow files only. This PR's own run is the check.
🤖 Generated with Claude Code