Repository navigation
ci: Pin third-party actions to commit SHAs and let Dependabot bump them - #830
Merged
Merged
Conversation
Ziinc
force-pushed
the
claude/speed-up-ci-aoedg6-node24
branch
from
October 12, 2026 06:50
2ab7879 to
d2c3f20
Compare
Ziinc
force-pushed
the
claude/speed-up-ci-aoedg6-pin-actions
branch
from
October 12, 2026 06:50
6b6c6d0 to
58e830c
Compare
Base automatically changed from
claude/speed-up-ci-aoedg6-node24
to
claude/speed-up-ci-aoedg6-unit-in-verify
October 12, 2026 11:33
Base automatically changed from
claude/speed-up-ci-aoedg6-unit-in-verify
to
main
October 12, 2026 11:33
A moved or compromised tag can no longer change what runs in CI. The branch refs dtolnay/rust-toolchain@stable and taiki-e/install-action@nextest become pinned tags with the equivalent toolchain and tool inputs. Dependabot opens one grouped github-actions PR a week. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uwdgq12RrXjifDLXargwye
Ziinc
force-pushed
the
claude/speed-up-ci-aoedg6-pin-actions
branch
from
October 12, 2026 11:35
58e830c to
9fbafe8
Compare
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Zn · project thread
actions/*action now uses a full commit SHA with its version in a trailing comment, so a moved or compromised tag can't change what runs.dtolnay/rust-toolchain@stableandtaiki-e/install-action@nextestbecome pinned tags with the equivalenttoolchain: stable/tool: cargo-nextestinputs..github/dependabot.ymlsends one groupedgithub-actionsPR per week. Stacked on ci: Move GitHub actions to their Node 24 majors #808.🤖 Generated with Claude Code
https://claude.ai/code/session_01Uwdgq12RrXjifDLXargwye
Generated by Claude Code