Skip to content

fix(ci): pin test service and job containers by digest (RE004) #945

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 14 commits into from
Oct 20, 2026
Merged

fix(ci): pin test service and job containers by digest (RE004) #945

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
8e55806
fix(ci): pass hypatia-ref aa34a4c to the standards scanner reusables
claude Oct 20, 2026
cb15dce
fix(rules): judge WH013 per job, and skip writes made with their own …
claude Oct 20, 2026
3fff249
Merge branch 'main' into claude/eager-wright-zwwbe2-wh013
hyperpolymath Oct 20, 2026
6ab2046
fix(ci): inbox-steward-intake publishes through PRs and fails loudly …
hyperpolymath Oct 20, 2026
69215c0
fix(rules): RE005 ignores trap handlers; unmask two workflow steps
claude Oct 20, 2026
78219af
fix(ci): pin test service and job containers by digest (RE004)
claude Oct 20, 2026
46f37d6
fix(rules): close four WH013 per-job gaps found in review
claude Oct 20, 2026
5d73357
fix(rules): RE005 ignores trap handlers; unmask two workflow steps (#…
hyperpolymath Oct 20, 2026
41723de
Merge branch 'claude/eager-wright-zwwbe2-wh013' into claude/eager-wri…
hyperpolymath Oct 20, 2026
183835d
Merge branch 'main' into claude/eager-wright-zwwbe2-wh013
hyperpolymath Oct 20, 2026
c8955b8
Merge branch 'claude/eager-wright-zwwbe2-wh013' into claude/eager-wri…
hyperpolymath Oct 20, 2026
2591153
fix(ci): harden-runner in block mode for the GitHub-API-only jobs (RE…
hyperpolymath Oct 20, 2026
5e9a5f3
fix(ci): keep the dispatched label workflows action-free
claude Oct 20, 2026
4afa4f1
Merge remote-tracking branch 'origin/main' into claude/eager-wright-z…
claude Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/ci-health-sweep.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,14 @@
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
# Egress allowlist (RE001): this job talks only to the GitHub API.
- name: Harden runner
uses: step-security/harden-runner@v2.22.2

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Regenerate the lockfile for the new action references

Regenerate and commit .github/workflows/actions.lock alongside the new action references in ci-health-sweep.yml, dependabot-automerge.yml, and roadmap-sync.yml. At this commit the lock still lists only each workflow's previous actions and contains no step-security/harden-runner@v2.22.2 dependency, so the repository's path-scoped lock verification rejects these mutable references and can leave the affected workflows at startup_failure.

Useful? React with 👍 / 👎.

@hyperpolymath hyperpolymath Oct 20, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. This is the open blocker for ci-health-sweep.yml, dependabot-automerge.yml and roadmap-sync.yml. actions.lock is tool-owned, and this session has no gh credential, so the owner has to regenerate it with gh actions-lock on this branch before this PR merges. It can't be fixed from inside this PR, so the thread stays open until the lock commit lands.

Generated by Claude Code

with:
egress-policy: block
allowed-endpoints: >
api.github.com:443
github.com:443
- uses: actions/checkout@v7.0.1
- name: Run CI-health sweep
env:
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/dependabot-automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,14 @@
pull-requests: write # needed to approve

steps:
# Egress allowlist (RE001): this job talks only to the GitHub API.
- name: Harden runner
uses: step-security/harden-runner@v2.22.2
with:
egress-policy: block
allowed-endpoints: >
api.github.com:443
github.com:443
- name: Fetch Dependabot metadata
id: meta
uses: dependabot/fetch-metadata@v3.1.0
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/escript-soundness.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ jobs:
needs: startup-probe
timeout-minutes: 20
container:
image: elixir:1.17-otp-27
image: elixir:1.17-otp-27@sha256:c65f0bdd8827df171963e3558a1461b04efc086d0d52ee7c6900fcddb4467e08
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
TARGET_REF: ${{ github.sha }}
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/roadmap-sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,14 @@
EXCLUDE: 'idaptik burble rattlescript vcl-ut'
WINDOW_MIN: ${{ inputs.window_min || '45' }} # look-back window (> cron interval for overlap)
steps:
# Egress allowlist (RE001): this job talks only to the GitHub API.
- name: Harden runner
uses: step-security/harden-runner@v2.22.2
with:
egress-policy: block
allowed-endpoints: >
api.github.com:443
github.com:443
- name: Mint App installation token
id: app
uses: actions/create-github-app-token@v3.3.0
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,7 +266,7 @@ jobs:
needs: [build-images]
services:
arangodb:
image: arangodb:3.11
image: arangodb:3.11@sha256:e83f37055170f647ebca1a09dd65ec850a578d8d4c9b90904de3359b909c1f16
env:
ARANGO_ROOT_PASSWORD: testpassword
ARANGO_NO_AUTH: "0"
Expand Down Expand Up @@ -308,7 +308,7 @@ jobs:
--health-start-period 40s

dragonfly:
image: docker.dragonflydb.io/dragonflydb/dragonfly:latest
image: ghcr.io/dragonflydb/dragonfly:v1.40.2@sha256:18afa43e911f1dff18c7d1eb452361876d9702bb1cdff5c5d75c69617a4065c9
ports:
- 6379:6379
options: >-
Expand Down Expand Up @@ -508,7 +508,7 @@ jobs:
needs: [integration-tests]
services:
arangodb:
image: arangodb:3.11
image: arangodb:3.11@sha256:e83f37055170f647ebca1a09dd65ec850a578d8d4c9b90904de3359b909c1f16
env:
ARANGO_ROOT_PASSWORD: testpassword
ports:
Expand Down Expand Up @@ -549,7 +549,7 @@ jobs:
--health-start-period 40s

dragonfly:
image: docker.dragonflydb.io/dragonflydb/dragonfly:latest
image: ghcr.io/dragonflydb/dragonfly:v1.40.2@sha256:18afa43e911f1dff18c7d1eb452361876d9702bb1cdff5c5d75c69617a4065c9
ports:
- 6379:6379
options: >-
Expand Down
Loading