fix(ci): make the pinned-actions linter a real gate, and check SHAs exist - #46
Conversation
…xist The 'Check pinned actions' step could not fail on any input: it set errors=0, only echoed a WARNING (never incrementing), and — unlike the two steps above it — ended without `exit $errors`. A policy declared but not enforced. It also globbed only .github/workflows, so the phantom pin in examples/oikosbot-ci.yml (#44) was structurally invisible to it. Now the step: - increments and exits, so it can actually fail; - scans examples/ as well as .github/workflows/; - flags tag/branch refs (shape check, as before, but enforced); - probes each 40-hex SHA against the GitHub API and fails if it is not a real commit. That last check is the one that matters. A phantom SHA is not a normal red: the ref resolves to nothing, the job dies in 'Set up job', and NO check run is produced — so it is invisible to `gh pr checks` and reads as green. Three distinct phantom codeql-action SHAs were in circulation across this repo and metadatastician-governance. Verified both directions: clean on this repo (exit 0), and a falsifier fixture containing one tag ref plus the real phantom SHA 39a73d65469e0144129775918a2032174234c279 exits 2 with both named. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedConverts the workflow pinned-actions linter into a blocking CI gate that scans examples and validates every SHA against the GitHub API. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
1 participant
The step that enforces SHA pinning could never fail.
workflow-linter.yml's Check pinned actions seterrors=0, onlyechoed a WARNING (never incrementing), and — unlike the two steps above it — ended with noexit $errors. A declared policy with no enforcement. It also globbed only.github/workflows, so the phantom pin inexamples/oikosbot-ci.yml(fixed in #44) was structurally invisible.Now it:
examples/too;That last check is the point. A phantom SHA isn't an ordinary red: the ref resolves to nothing, the job dies in Set up job, and no check run is produced at all — invisible to
gh pr checks, indistinguishable from green. Three distinct phantomcodeql-actionSHAs were circulating across this repo and metadatastician-governance.Verified both directions (a gate I cannot prove will fail is the exact thing being fixed here):
39a73d65…→ exit 2, both named, the phantom caught insideexamples/.🤖 Generated with Claude Code