ci: pin required repo-checks verifiers to immutable SHAs

[nish3451]

Sol sweep product-ci F2 (MEDIUM): the required repo-checks job ran on mutable verifiers — a commit did not identify the code that checked it.

• actions/checkout@v7 → SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 (# v7.0.1), the commit the tag points at today
• actions/setup-node@v7 → SHA 820762786026740c76f36085b0efc47a31fe5020 (# v7.0.0), the commit the tag points at today

No version bumps: each pin resolves to the exact commit the moving tag points to today. Remaining tag-based uses are all in non-required jobs (codeql analyze, deploy publish, live-site live-soft-404). Local npm run ci green under runner conditions.

Summary by CodeRabbit

• Chores
  • Improved CI workflow security by pinning build actions to immutable versions.
  • Retained the existing release versions while ensuring consistent workflow execution.

[greptile-apps]

nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CI workflow now pins actions/checkout and actions/setup-node to immutable commit SHAs instead of mutable v7 tags.

Changes

CI action pinning

Layer / File(s)	Summary
Pin workflow actions .github/workflows/codex-ci.yml	The workflow uses immutable commit SHAs for actions/checkout and actions/setup-node while retaining their v7 releases.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• nish3451/tinystudio-in#7: Updates the actions/setup-node declaration in the same workflow.
• nish3451/0509#490: Updates pinned actions/checkout and actions/setup-node references in another workflow.

Suggested labels: github_actions

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes pinning the required repo-checks verifier actions to immutable SHAs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/pin-required-verifiers

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/codex-ci.yml:
- Line 22: Update the actions/checkout step in the workflow to set
persist-credentials to false, preventing checkout credentials from remaining
available to pull-request CI scripts.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5ce7c1fe-3c3e-469d-84d7-1185cba2eeb8

📥 Commits

Reviewing files that changed from the base of the PR and between 6817d6c and f73aba8.

📒 Files selected for processing (1)

• .github/workflows/codex-ci.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- workflow ---'
cat -n .github/workflows/codex-ci.yml

printf '%s\n' '--- workflow references ---'
rg -n -C 3 'codex-ci|npm run ci|actions/checkout|persist-credentials|self-hosted|GITHUB_TOKEN|git (clone|fetch|push)|github-token' .github package.json package-lock.json 2>/dev/null || true

printf '%s\n' '--- package scripts ---'
node - <<'JS'
const fs = require('fs');
const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
console.log(JSON.stringify(p.scripts ?? {}, null, 2));
JS

Repository: nish3451/tinystudio-in

Length of output: 13461

---

🏁 Script executed:

#!/bin/bash
set -eu

python3 - <<'PY'
import json
import pathlib
import re

pkg = json.loads(pathlib.Path("package.json").read_text())
ci = pkg.get("scripts", {}).get("ci", "")
scripts = re.findall(r"(?:^|&&\s*)node\s+((?:scripts/)[^\s]+)", ci)

print("--- ci script files ---")
for name in scripts:
    print(name)

print("--- credential-related references in CI scripts ---")
terms = re.compile(r"\b(?:git|GITHUB_TOKEN|github-token|contents:|actions/checkout)\b", re.I)
hits = 0
for name in scripts:
    path = pathlib.Path(name)
    if not path.is_file():
        print(f"{name}: missing")
        continue
    for number, line in enumerate(path.read_text(errors="replace").splitlines(), 1):
        if terms.search(line):
            print(f"{name}:{number}:{line}")
            hits += 1
print(f"matches={hits}")
PY

printf '%s\n' '--- all workflow credential and Git operations ---'
rg -n -i -C 2 'git (clone|fetch|pull|push|remote|ls-remote)|GITHUB_TOKEN|github-token|persist-credentials|contents:' .github/workflows scripts package.json 2>/dev/null || true

Repository: nish3451/tinystudio-in

Length of output: 4300

---

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- retention test and helper structure ---'
ast-grep outline scripts/test-retention-automation.mjs scripts/lib/retention-preflight.mjs

printf '%s\n' '--- retention test ---'
cat -n scripts/test-retention-automation.mjs

printf '%s\n' '--- retention helper ---'
cat -n scripts/lib/retention-preflight.mjs

printf '%s\n' '--- imports and Git process calls ---'
rg -n -i -C 3 'retention-preflight|spawnSync|execFileSync|execSync|git\s+(ls-remote|fetch|clone|pull|push)|remote\.|origin' scripts

Repository: nish3451/tinystudio-in

Length of output: 50379

---

Disable checkout credential persistence.

This workflow runs pull-request code on a self-hosted runner. The CI scripts do not need authenticated Git access. Add persist-credentials: false to actions/checkout.

🧰 Tools

🪛 zizmor (1.29.0)

[warning] 22-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codex-ci.yml at line 22, Update the actions/checkout step
in the workflow to set persist-credentials to false, preventing checkout
credentials from remaining available to pull-request CI scripts.

Source: Linters/SAST tools

[greptile-apps]

nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.