ci: pin actions to SHAs and add dependabot config#3494
Conversation
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (18)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (31)
🧰 Additional context used🧠 Learnings (12)📚 Learning: 2026-01-15T10:48:02.687ZApplied to files:
📚 Learning: 2026-04-15T15:39:06.868ZApplied to files:
📚 Learning: 2026-04-16T14:19:16.330ZApplied to files:
📚 Learning: 2024-09-23T12:51:42.019ZApplied to files:
📚 Learning: 2026-03-02T12:43:34.140ZApplied to files:
📚 Learning: 2026-03-02T12:43:34.140ZApplied to files:
📚 Learning: 2026-04-15T15:39:06.868ZApplied to files:
📚 Learning: 2026-04-15T15:39:06.868ZApplied to files:
📚 Learning: 2025-06-25T13:24:23.836ZApplied to files:
📚 Learning: 2026-03-25T15:29:25.889ZApplied to files:
📚 Learning: 2025-11-27T16:26:37.432ZApplied to files:
📚 Learning: 2026-02-03T18:27:05.229ZApplied to files:
🔇 Additional comments (18)
WalkthroughThis pull request adds Dependabot configuration for GitHub Actions dependency updates and systematically pins GitHub Actions across 17 CI/CD workflow files to specific commit SHAs. The changes replace floating major-version tags ( Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
|
ready |
Dependabot's first auto-bump PR (#3495) was auto-closed because `dependabot[bot]` isn't in the vouch list and isn't exempt from the require-draft check. Two changes: - Add `dependabot[bot]` to `.github/VOUCHED.td` so the vouch check passes. - Add `dependabot[bot]` to the require-draft exception in `vouch-check-pr.yml` (alongside `devin-ai-integration[bot]`) so its PRs aren't closed for being non-draft. Without both, dependabot bumps will keep getting closed and we lose the weekly action update flow that #3494 set up.
Last action still firing the Node 20 deprecation warning after #3494. `buildjet/setup-node@v4.0.4` (the latest tag) declares `runs: using: 'node20'` and the repo hasn't shipped a node24 update. Workflows here run on `ubuntu-latest` (not buildjet runners), so the buildjet fork wasn't giving us anything we don't get from `actions/setup-node` directly. Swapping to `actions/setup-node@v6.4.0` (node24 runtime) silences the warning.
2 participants
Most actions in this repo were several major versions behind, which is why every CI run has been emitting Node 20 deprecation warnings.
Pinning every action to a commit SHA (with the version as a trailing comment) means each CI run uses the exact code that was reviewed when the bump landed, instead of whatever a maintainer last pointed the major tag at. Dependabot is configured to group all action bumps into one weekly PR with a 7-day cooldown.
Worth flagging:
--modelinclaude_args, so SHA-pinning the action gives reproducibility without locking the model.docker://image:tag@sha256:...). Dependabot's github-actions ecosystem doesn't trackdocker://references (explicit TODO in dependabot-core), so it needs manual bumps either way - but the digest pin protects against tag repointing for free.