ci: pin all versions for third party actions#271
Merged
Conversation
Signed-off-by: Brooke Storm <brookes@nvidia.com>
crookedstorm
force-pushed
the
better-ci-positioning/crookedstorm
branch
from
41d92f2 to
f50e1e3
Compare
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughPins third-party GitHub Actions to fixed commit SHAs and updates the composite wheel-build action: adds ChangesGitHub Actions SHA pinning and composite action updates
Sequence Diagram(s)sequenceDiagram
participant buildAction as build-nemo-platform-wheel
participant Repo as Repository
participant NodeSetup as actions/setup-node
participant Corepack as Corepack
buildAction->>Repo: read package.json & pnpm-lock.yaml (studio-web-root)
buildAction->>NodeSetup: setup-node (pinned)
buildAction->>Corepack: install corepack@0.31.0 && corepack enable
buildAction->>Corepack: corepack prepare pnpm@<declared> --activate
Corepack->>buildAction: pnpm available (version printed)
sequenceDiagram
participant planRelease as plan-release
participant buildSdks as build-sdks
participant assemble as assemble-release-bundle
participant checkout as actions/checkout
participant upload as actions/upload-artifact
participant download as actions/download-artifact
participant setupUv as astral-sh/setup-uv
planRelease->>checkout: checkout workflow (pinned)
buildSdks->>checkout: checkout workflow & source (pinned)
buildSdks->>upload: upload SDK wheel (pinned)
assemble->>download: download SDK wheels (pinned)
assemble->>setupUv: install uv (pinned)
Possibly related issues
Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
Signed-off-by: Brooke Storm <brookes@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security.yaml:
- Around line 29-32: The checkout step using actions/checkout (the line "uses:
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10") is leaving Git
credentials available to later steps; update that checkout step to include the
input persist-credentials: false under its with block (alongside fetch-depth: 0)
so credentials are not persisted to subsequent steps or artifacts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 66c768b5-223d-48e3-bd2a-a8e276aaaa3d
📒 Files selected for processing (4)
.github/actions/build-nemo-platform-wheel/action.yaml.github/workflows/release-bundle.yaml.github/workflows/security.yaml.github/workflows/semantic-pull-requests.yaml
Signed-off-by: Brooke Storm <brookes@nvidia.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/build-nemo-platform-wheel/action.yaml:
- Around line 122-129: The "Set up Node.js" step currently enables pnpm caching
before pnpm is installed later by the Corepack/pnpm step; move the Corepack
bootstrap/pnpm installation to run before the "Set up Node.js" step (or
alternately remove the cache: pnpm option and add caching after pnpm is
installed) so that actions/setup-node sees pnpm when enabling cache. Update the
workflow so the step that installs pnpm via Corepack (the pnpm installation step
referenced after lines 130-165) executes prior to the actions/setup-node step
named "Set up Node.js" (or adjust the cache configuration to run after
installation).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 048b5ea0-5b6a-461e-9d33-7ae2de352d84
📒 Files selected for processing (1)
.github/actions/build-nemo-platform-wheel/action.yaml
Signed-off-by: Brooke Storm <brookes@nvidia.com>
Signed-off-by: Brooke Storm <brookes@nvidia.com>
svvarom
reviewed
Jun 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a step toward automating actions updates with dependabot and maintaining a better security posture.
Summary by CodeRabbit
New Features
Chores