fix(ci): accept rotated pinned checkout digests - #1799
Conversation
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
Pull request overview
This PR updates the release-workflow regression test to tolerate actions/checkout digest rotations while still enforcing an immutable, lowercase 40-hex SHA pin for the provenance recovery checkout step, preventing Renovate digest bumps from breaking CI.
Changes:
- Parameterizes the provenance recovery test to cover a rotated
actions/checkoutdigest scenario. - Replaces an exact
actions/checkout@<sha>equality assertion with a regex check that enforces a 40-character lowercase SHA pin.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if updated_checkout_digest is not None: | ||
| checkout_step = {**checkout_step, "uses": f"actions/checkout@{updated_checkout_digest}"} | ||
| assert re.fullmatch(r"actions/checkout@[0-9a-f]{40}", checkout_step["uses"]) |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Summary
actions/checkoutcommit digests while still requiring an immutable, lowercase 40-character SHA pin.Validation
PYTHONPATH=$PWD:$PWD/packages/modelaudit-picklescan/src PROMPTFOO_DISABLE_TELEMETRY=1 /Users/mdangelo/code/modelaudit/.venv/bin/python -m pytest tests/test_release_workflow.py -q --tb=short— 133 passed.PYTHONPATH=$PWD:$PWD/packages/modelaudit-picklescan/src PROMPTFOO_DISABLE_TELEMETRY=1 /Users/mdangelo/code/modelaudit/.venv/bin/python -m pytest packages/modelaudit-picklescan/tests/test_call_graph_instance_defaults.py -q --tb=short— 4 passed, including the exact failing Nightly botocore case./Users/mdangelo/code/modelaudit/.venv/bin/ruff check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/— passed./Users/mdangelo/code/modelaudit/.venv/bin/ruff format --check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/— 424 files already formatted.PYTHONPATH=$PWD:$PWD/packages/modelaudit-picklescan/src /Users/mdangelo/code/modelaudit/.venv/bin/mypy tests/test_release_workflow.py— passed.mainPython CI is green.CI context
Renovate PR #1797 currently fails all affected Python, Windows, and coverage lanes solely because the release test hard-codes the previous checkout digest. This change keeps the supply-chain pinning requirement and removes that false failure.