GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Pin `setup-node` action to a commit hash by ShaharNaveh · Pull Request #7495 · RustPython/RustPython

Conversation

@ShaharNaveh

@ShaharNaveh ShaharNaveh commented Mar 24, 2026 •
edited by coderabbitai Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • Chores
    • Updated CI/CD build configuration for improved consistency and reliability in the development pipeline.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@coderabbitai

coderabbitai Bot commented Mar 24, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: f64d73a3-d1e9-4b20-94f7-cb2d59a4a001

📥 Commits

Reviewing files that changed from the base of the PR and between 0270247 and 4aaa661.

📒 Files selected for processing (1)
  • .github/workflows/ci.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/ci.yaml
📝 Walkthrough

Walkthrough

A GitHub Actions step in the wasm job is updated to pin the Node.js setup action from a floating version tag (v6) to a specific commit hash (53b83947a5a98c8d113130e565377fae1a50d02f, corresponding to v6.3.0), ensuring reproducible and consistent workflow behavior.

Changes

Cohort / File(s) Summary
GitHub Actions Version Pinning
.github/workflows/ci.yaml		 Node.js setup action pinned to specific commit hash in wasm job for improved reproducibility and security.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

  • Pin setup-python action to a commit hash - part 1 #7492: Pins actions/setup-python in the same CI workflow file as part of a broader pattern of hardening GitHub Actions dependencies.

Suggested reviewers

  • youknowone

Poem

🐰 A version floated in the air so free,
Now pinned to commit—precise as can be!
Reproducible runs, no surprises in sight,
Our workflows are locked and forever so tight! 🔒

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and specifically describes the main change: pinning the setup-node action to a commit hash, which matches the actual modification in .github/workflows/ci.yaml.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
  • X
  • Mastodon
  • Reddit
  • LinkedIn

Comment @coderabbitai help to get the list of available commands and usage tips.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
github-advanced-security[bot]
github-advanced-security AI found potential problems Mar 24, 2026
View reviewed changes
Comment thread .github/workflows/ci.yaml Outdated

Check failure

Code scanning / zizmor

runtime artifacts potentially vulnerable to a cache poisoning attack Error

runtime artifacts potentially vulnerable to a cache poisoning attack
@ShaharNaveh

ShaharNaveh commented Mar 24, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

Security failures are unrelated to this PR
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ShaharNaveh

ShaharNaveh commented Mar 24, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

Security failures are unrelated to this PR

Should be fixed at 0270247 (wasn't related to changes in this PR)

changes to release. yml are now proposed at #7499
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ShaharNaveh
ShaharNaveh force-pushed the setup-node-pin branch from 61f0b13 to 0270247 Compare March 24, 2026 08:44
ShaharNaveh added 3 commits March 24, 2026 10:14
@ShaharNaveh
Pin setup-node action to a commit hash
ff2b3ee
@ShaharNaveh
Don't use cache for release
778b26e
@ShaharNaveh
Revert changes of release.yml
4aaa661
@ShaharNaveh
ShaharNaveh force-pushed the setup-node-pin branch from f5f9594 to 4aaa661 Compare March 24, 2026 09:14
youknowone
youknowone approved these changes Mar 25, 2026
View reviewed changes
@youknowone
youknowone merged commit 211649d into RustPython:main Mar 25, 2026
18 checks passed

Uh oh!

There was an error while loading. Please reload this page.
Copilot AI pushed a commit that referenced this pull request Mar 25, 2026
@ShaharNaveh
Pin setup-node action to a commit hash (#7495)
76ddf11 
* Pin `setup-node` action to a commit hash

* Don't use cache for release

* Revert changes of `release.yml`
youknowone pushed a commit that referenced this pull request Sep 16, 2026
@ShaharNaveh
Pin setup-node action to a commit hash (#7495)
c0d829e 
* Pin `setup-node` action to a commit hash

* Don't use cache for release

* Revert changes of `release.yml`
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@youknowone youknowone youknowone approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@ShaharNaveh @youknowone @github-advanced-security
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.