🐛 removing references to my fork's actions/workflows#193
Conversation
Signed-off-by: Shawn Hurley <shawn@hurley.page>
|
No actionable comments were generated in the recent review. 🎉 📝 WalkthroughWalkthroughUpdated two GitHub workflow files: Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/build-nightly-images.yaml (1)
65-65: Consider SHA pinning for@main— same rationale askoncur-kantra.
konveyor/ci/build-image@mainis mutable. Pinning to a specific commit SHA ensures nightly image builds are reproducible and not inadvertently broken by unrelated changes to thebuild-imageaction in the same repo.💡 Example with SHA pinning
- uses: konveyor/ci/build-image@main + uses: konveyor/ci/build-image@<SHA> # main as of YYYY-MM-DD🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/build-nightly-images.yaml at line 65, The workflow uses the mutable action reference konveyor/ci/build-image@main which risks non-reproducible/nightly breaks; replace the `@main` tag with a specific commit SHA for konveyor/ci/build-image (e.g., konveyor/ci/build-image@<commit-sha>) so the workflow pins to an immutable revision—update the uses line that currently contains konveyor/ci/build-image@main to the chosen commit SHA and commit the change..github/workflows/nightly-koncur.yaml (1)
164-164: Consider pinning to a SHA instead of@mainfor stability.Using
@mainis a mutable reference — any commit tokonveyor/ci:maincan silently alter this action's behavior. For a CI action used in nightly runs, pinning to a specific SHA (with a comment tracking the intended version) gives a reproducible, auditable reference and prevents unexpected breakage.💡 Example with SHA pinning
- uses: konveyor/ci/koncur-kantra@main + uses: konveyor/ci/koncur-kantra@<SHA> # main as of YYYY-MM-DD🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/nightly-koncur.yaml at line 164, Replace the mutable tag on the GitHub Action usage to a specific commit SHA to ensure reproducible runs: change the uses entry "konveyor/ci/koncur-kantra@main" to "konveyor/ci/koncur-kantra@<commit-sha>" (use the SHA of the intended release/commit) and add a short comment noting the chosen SHA and why it was pinned; update any workflow documentation or PR description to record the pinned version for future updates.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/build-nightly-images.yaml:
- Line 65: The workflow uses the mutable action reference
konveyor/ci/build-image@main which risks non-reproducible/nightly breaks;
replace the `@main` tag with a specific commit SHA for konveyor/ci/build-image
(e.g., konveyor/ci/build-image@<commit-sha>) so the workflow pins to an
immutable revision—update the uses line that currently contains
konveyor/ci/build-image@main to the chosen commit SHA and commit the change.
In @.github/workflows/nightly-koncur.yaml:
- Line 164: Replace the mutable tag on the GitHub Action usage to a specific
commit SHA to ensure reproducible runs: change the uses entry
"konveyor/ci/koncur-kantra@main" to "konveyor/ci/koncur-kantra@<commit-sha>"
(use the SHA of the intended release/commit) and add a short comment noting the
chosen SHA and why it was pinned; update any workflow documentation or PR
description to record the pinned version for future updates.
Signed-off-by: Shawn Hurley <shawn@hurley.page>
Summary by CodeRabbit
Chores
Impact