Skip to content

ci(github): Update GitHub actions to use specific commit hashes and add names for all workflow jobs. - #781

Merged
kirkrodrigues merged 2 commits into
y-scope:mainfrom
Eden-D-Zhang:action-hashes
Mar 27, 2025
Merged

ci(github): Update GitHub actions to use specific commit hashes and add names for all workflow jobs.#781
kirkrodrigues merged 2 commits into
y-scope:mainfrom
Eden-D-Zhang:action-hashes

Conversation

@Eden-D-Zhang

@Eden-D-Zhang Eden-D-Zhang commented Mar 20, 2025 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Description

This PR updates actions used in our workflows to specific commit hashes. This change intends to improve security and stability by avoiding the possibility of changes to the actions having an effect on our workflows.
This PR also adds names to workflows that do not already have one.

Checklist

  • The PR satisfies the contribution guidelines.
  • This is a breaking change and that has been indicated in the PR title, OR this isn't a
    breaking change.
  • Necessary docs have been updated, OR no docs need to be updated.

Validation performed

  • Successfully ran CI workflows with new changes.

Summary by CodeRabbit

  • Chores
    • Improved workflow stability by pinning external dependency versions.
    • Standardised job names in automation pipelines for greater clarity and consistency.

These changes enhance the reliability and traceability of our build, test, and deployment processes.

@Eden-D-Zhang
Eden-D-Zhang requested a review from a team as a code owner March 20, 2025 16:08
@coderabbitai

coderabbitai Bot commented Mar 20, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Walkthrough

This pull request updates multiple GitHub Actions workflows and custom action definitions by replacing version tags with explicit commit hashes. In addition, several workflows have been enhanced with explicit job names. The changes affect Docker actions, artifact handling, and other utility actions like checkout and setup-python within both custom actions and workflow definitions, thereby pinning the actions to known, fixed states.

Changes

File(s) Change Summary
.../clp-core-build-containers/action.yaml
.../clp-execution-image-build/action.yaml
.../run-on-image/action.yaml		 Updated action references: Docker actions (setup-buildx, login, metadata, build-push) and artifact actions (download/upload) now use specific commit hashes instead of version tags.
.../clp-core-build-macos.yaml
.../clp-core-build.yaml
.../clp-docs.yaml
.../clp-execution-image-build.yaml
.../clp-lint.yaml
.../clp-pr-title-checks.yaml		 Added explicit job names and updated various action versions (checkout, setup-python, paths-filter, semantic pull-request, etc.) to fixed commit references for improved reproducibility and clarity.

Possibly related PRs

Suggested reviewers

  • davidlion
📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 5474ab2 and f34e323.

📒 Files selected for processing (9)
  • .github/actions/clp-core-build-containers/action.yaml (3 hunks)
  • .github/actions/clp-execution-image-build/action.yaml (2 hunks)
  • .github/actions/run-on-image/action.yaml (1 hunks)
  • .github/workflows/clp-core-build-macos.yaml (2 hunks)
  • .github/workflows/clp-core-build.yaml (13 hunks)
  • .github/workflows/clp-docs.yaml (2 hunks)
  • .github/workflows/clp-execution-image-build.yaml (3 hunks)
  • .github/workflows/clp-lint.yaml (1 hunks)
  • .github/workflows/clp-pr-title-checks.yaml (1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (4)
  • GitHub Check: build-macos (macos-13, false)
  • GitHub Check: build-macos (macos-13, true)
  • GitHub Check: lint-check (macos-latest)
  • GitHub Check: lint-check (ubuntu-latest)
🔇 Additional comments (44)
.github/actions/run-on-image/action.yaml (1)

19-19: Specific Commit Pin for Download-Artifact Action

The commit hash for the actions/download-artifact action has been updated to a specific commit (95815c38cf2ff2164869cbab79da8d1f422bc89e), which improves workflow stability and security. Please ensure that this pinned commit is monitored for any future security updates.

.github/workflows/clp-core-build-macos.yaml (2)

44-45: Job Naming for Clarity

The addition of name: "build-macos" for the job clearly labels the workflow step, enhancing readability and traceability in the GitHub Actions dashboard.

56-56: Pinned Checkout Action Commit

Updating the actions/checkout action to the specific commit 11bd71901bbe5b1630ceea73d27597364c9af683 ensures consistency and avoids issues that might arise from floating tags. This change is in line with the broader security improvements.

.github/workflows/clp-lint.yaml (3)

18-18: Naming the Lint-Check Job

Assigning the job a name ("lint-check") makes it easier to identify and debug in the workflow logs. This improves overall clarity.

24-24: Consistent Checkout Action Versioning

The actions/checkout action has been updated to use a specific commit hash (11bd71901bbe5b1630ceea73d27597364c9af683), ensuring that its behaviour remains predictable and secure.

28-28: Specific Setup-Python Action Version

Using the commit hash 42375524e23c412d93fb67b49958b491fce71c38 for actions/setup-python enhances security by avoiding future breaking changes from floating versions. This change aligns well with the repository-wide update.

.github/workflows/clp-pr-title-checks.yaml (2)

23-24: Job Name Added for Conventional Commits

The explicit naming of the job as "conventional-commits" improves clarity in the workflow, making it easier to locate and troubleshoot issues related to pull request title checks.

29-29: Pinned Action Version for Semantic PR

The amannn/action-semantic-pull-request action is now pinned to a specific commit (0723387faaf9b38adef4775cd42cfd5155ed6017), which strengthens the stability and security of the action by ensuring a known state. This is consistent with the other workflow updates.

.github/workflows/clp-execution-image-build.yaml (5)

26-27: Naming the Filter-Relevant-Changes Job

Introducing the job name "filter-relevant-changes" clarifies its purpose in the workflow. This naming convention will help in tracking and debugging the workflow more efficiently.

31-31: Locked Checkout Action in Filter Job

The checkout action in this job is pinned to the specific commit (11bd71901bbe5b1630ceea73d27597364c9af683), ensuring a stable and reproducible environment.

40-41: Pinned Paths-Filter Action Commit

The update to the dorny/paths-filter action with the commit de90cc6fb38fc0963ad72b210f1f284cd68cea36 ensures that the filtering mechanism remains reliable by avoiding unexpected changes from a mutable tag.

50-52: Defining the Ubuntu Jammy Execution Image Job

The newly added job "ubuntu-jammy-execution-image" with an explicit name improves transparency and monitoring. This clear naming, along with the conditional check and dependencies setup, supports a better workflow structure.

56-57: Consistent Checkout in Execution Job

The checkout action within the "ubuntu-jammy-execution-image" job is also pinned to the same commit (11bd71901bbe5b1630ceea73d27597364c9af683), ensuring uniformity and reducing the risk of discrepancies across jobs.

.github/workflows/clp-docs.yaml (4)

18-19: Explicit Job Naming:
The addition of an explicit job name "build" improves clarity in the workflow and aids in debugging and reporting within CI.

24-24: Pinned Checkout Action:
Updating the checkout action to a specific commit (11bd71901bbe5b1630ceea73d27597364c9af683) ensures reproducibility and improves security. Verify that this commit is the approved stable version.

28-29: Pinned Setup-Python Action:
Pinning the actions/setup-python action to commit 42375524e23c412d93fb67b49958b491fce71c38 is a favourable security enhancement that guarantees consistency across runs.

49-49: Pinned Upload-Artifact Action:
The update of actions/upload-artifact to a specific commit (ea165f8d65b6e75b540449e92b4886f43607fa02) is a positive step toward improved stability.

.github/actions/clp-execution-image-build/action.yaml (4)

30-31: Pinned Docker Buildx Action:
Using docker/setup-buildx-action at commit b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 rather than a version tag mitigates the risk of unexpected behaviour from upstream changes.

33-34: Pinned Login Action:
The update to docker/login-action pinned at commit 74a5d142397b4f367a81961eba4e8cd7edddf772 is commendable for ensuring that authentication behaviour remains predictable.

50-51: Pinned Metadata Action:
By specifying docker/metadata-action at commit 902fa8ec7d6ecbf8d84d538b9b233a880e428804, the workflow now relies on a fixed version, enhancing overall reliability.

57-58: Pinned Build-Push Action:
Pinning docker/build-push-action to commit 471d1dc4e07e5cdedd4c2171150001c434f0b7a4 in the build-and-push step is an excellent security-oriented practice. Ensure that the conditional logic (if: "github.event_name != 'pull_request' && github.ref == 'refs/heads/main'") meets the deployment requirements.

.github/actions/clp-core-build-containers/action.yaml (5)

24-24: Pinned Docker Buildx in Containers Build:
The update of docker/setup-buildx-action to commit b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 ensures consistent build environments during container image creation.

27-28: Pinned Login Action for Container Build:
Pinning docker/login-action at commit 74a5d142397b4f367a81961eba4e8cd7edddf772 under the condition for pushing images reinforces security for registry logins.

55-56: Pinned Metadata Action for Dependencies Image:
Using docker/metadata-action at commit 902fa8ec7d6ecbf8d84d538b9b233a880e428804 secures the process of generating image metadata.

61-62: Pinned Build-Push Action for Container Image:
The update to pin docker/build-push-action to commit 471d1dc4e07e5cdedd4c2171150001c434f0b7a4 is consistent with other workflow changes and improves build reproducibility.

70-71: Pinned Upload-Artifact Action for Fallback:
For the scenario when push_deps_image is false, pinning actions/upload-artifact to commit ea165f8d65b6e75b540449e92b4886f43607fa02 is a thoughtful addition to maintain consistency across workflows.

.github/workflows/clp-core-build.yaml (18)

40-41: Explicit Job Naming (Filter Relevant Changes):
Assigning the explicit job name "filter-relevant-changes" enhances readability and assists in tracking job outputs, particularly when running complex workflows.

47-49: Consistent Checkout Action:
The checkout step using the pinned commit (11bd71901bbe5b1630ceea73d27597364c9af683) in the filter-relevant-changes job is applied consistently; this benefits overall pipeline security and stability.

56-57: Pinned Paths-Filter Action:
Updating the dorny/paths-filter action to commit de90cc6fb38fc0963ad72b210f1f284cd68cea36 improves determinism in detecting relevant changes.

95-96: Explicit Job Naming (Centos-Stream-9 Deps Image):
Setting the job name to "centos-stream-9-deps-image" makes job identification easier and aligns with naming conventions applied elsewhere.

100-101: Pinned Checkout in Deps Image Build:
The checkout step in the centos-stream-9-deps-image job now uses a specific commit, ensuring consistency across jobs.

121-122: Explicit Job Naming (Ubuntu-Jammy Deps Image):
Naming the job "ubuntu-jammy-deps-image" clearly conveys its purpose and maintains uniformity across the CI configuration.

126-127: Consistent Checkout in Deps Image Build:
The checkout step in the ubuntu-jammy-deps-image job also employs the pinned commit for consistent results.

161-162: Consistent Checkout in Binaries Job (Centos-Stream-9):
The checkout action in the centos-stream-9-binaries job is now pinned, which is a positive change for ensuring the build’s reproducibility.

206-207: Consistent Checkout in Binaries Job (Ubuntu-Jammy):
Using the pinned checkout commit in the ubuntu-jammy-binaries job enhances consistency across different build environments.

240-241: Pinned Upload-Artifact Action for Binaries:
Pinning the actions/upload-artifact action to commit ea165f8d65b6e75b540449e92b4886f43607fa02 in this step maintains uniformity throughout the workflows.

247-248: Explicit Job Naming (Ubuntu-Jammy Binaries Image):
Assigning the job name "ubuntu-jammy-binaries-image" adds clarity to the workflow and simplifies monitoring and debugging.

256-257: Consistent Checkout in Binaries Image Build:
Using the pinned commit for the checkout step in the ubuntu-jammy-binaries-image job is consistent with the rest of the workflows.

264-265: Pinned Download-Artifact Action:
The updated usage of actions/download-artifact pinned to commit 95815c38cf2ff2164869cbab79da8d1f422bc89e ensures that the artifact retrieval step is stable and predictable.

276-277: Pinned Docker Login Action:
The docker login step now uses docker/login-action pinned at commit 74a5d142397b4f367a81961eba4e8cd7edddf772, which is critical for a secure login to the container registry.

292-293: Pinned Metadata Action (Core Image Meta):
Pinning the docker/metadata-action at commit 902fa8ec7d6ecbf8d84d538b9b233a880e428804 provides consistency in how image metadata is generated in the core build job.

301-303: Pinned Build-Push Action (Core Image Deployment):
Using a specific commit for the docker/build-push-action (471d1dc4e07e5cdedd4c2171150001c434f0b7a4) in the image build and push step reinforces reliability during deployment.

310-311: Explicit Job Naming (Ubuntu-Jammy Lint):
Providing the job with the name "ubuntu-jammy-lint" clarifies its purpose and aligns with the naming conventions used for other jobs.

320-321: Consistent Checkout for Linting:
The checkout step in the ubuntu-jammy-lint job correctly uses the pinned commit, ensuring that the linting process evaluates the expected code state.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

kirkrodrigues
kirkrodrigues reviewed Mar 24, 2025
View reviewed changes
Comment thread .github/workflows/clp-core-build.yaml
clp_changed: "${{steps.filter.outputs.clp}}"
steps:
- uses: "actions/checkout@v4"
- uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"

@kirkrodrigues kirkrodrigues Mar 24, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible to use a variable instead of repeating the hash in multiple places in this file? (I haven't tried myself.)

@Eden-D-Zhang Eden-D-Zhang Mar 25, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apparently they can be configured as variables through repository settings on github if we want to look into that.

@kirkrodrigues kirkrodrigues Mar 25, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you have a link to the docs about it?

@Eden-D-Zhang Eden-D-Zhang Mar 25, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables

@kirkrodrigues kirkrodrigues Mar 26, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you test if it works using your fork?

@Eden-D-Zhang Eden-D-Zhang Mar 27, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Passing repository variables directly to the uses: statement (i.e: uses: "actions/checkout@${{ CHECKOUT_VERSION }}") doesn't work, since dynamic values aren't allowed. https://github.com/orgs/community/discussions/25246

There might be some kind of workaround but I'm not sure.

kirkrodrigues
kirkrodrigues approved these changes Mar 27, 2025
View reviewed changes

@kirkrodrigues kirkrodrigues left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the PR title, how about:

ci(github): Update GitHub actions to use specific commit hashes and add names for all workflow jobs.

@Eden-D-Zhang Eden-D-Zhang changed the title ci(github): Update github actions to use specific commit hashes and add names for jobs. ci(github): Update GitHub actions to use specific commit hashes and add names for all workflow jobs. Mar 27, 2025
@kirkrodrigues
kirkrodrigues merged commit 711460a into y-scope:main Mar 27, 2025
@coderabbitai coderabbitai Bot mentioned this pull request Sep 2, 2025
Merged
5 tasks
junhaoliao pushed a commit to junhaoliao/clp that referenced this pull request May 17, 2026
@Eden-D-Zhang
ci(github): Update GitHub actions to use specific commit hashes and a…
14ca7db 
…dd names for all workflow jobs. (y-scope#781)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kirkrodrigues kirkrodrigues kirkrodrigues approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Eden-D-Zhang @kirkrodrigues