Repository navigation
ci(workflow-linter): install Bun 1.4.2 verified, not via setup-bun - #249
Merged
Merged
Conversation
The linter ran oven-sh/setup-bun@v2.2.0 with bun-version: latest, so its
runtime was unpinned. SonarCloud also rates a third-party action pinned
by tag "C" ("Use full commit SHA hash"), although actions.lock pins its
commit, and that rating fails network-ambulance#81, which copied the
step. The linter now downloads the Bun 1.4.2 release archive and checks
its sha256, as Estate Rules installs nickel, just and yq.
The linter's lock edge to setup-bun goes. The setup-bun@v2.2.0 record
stays: the commented Bun steps in e2e.yml.template resolve through it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 8 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
hyperpolymath
marked this pull request as ready for review
October 19, 2026 23:05
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
hyperpolymath
enabled auto-merge (squash)
October 19, 2026 23:05
The merge of main (f253649) kept main's changelog entry and dropped this PR's. This restores it unchanged, on the owner's call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
|
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 19, 2026
#249 landed on main (6a8bd11). It and this branch each added a Changed entry at the top of the changelog. Both are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
hyperpolymath
added a commit
to hyperpolymath/network-ambulance
that referenced
this pull request
Oct 20, 2026
## Why Workflow Security Linter's "Check SHA-Pinned Actions" step requires an inline 40-hex SHA on every `uses:` line. This repository pins its actions with tag refs that `actions.lock` resolves, so the step rejects every one of them. That keeps the linter red on main whatever else it finds. This is the second failing step, after the SPDX check that #80 fixes. ## What - The step now runs `scripts/check-action-pinning.js`, copied unchanged from rsr-template-repo (ec33724). A ref passes when it is an inline SHA or when `actions.lock` resolves it. - The script runs under Bun 1.4.2, the estate pin. A new "Install verified Bun 1.4.2" step downloads it from the release archive and checks its sha256, as hyperpolymath/rsr-template-repo#249 now does in the template. - bf2a196 first used the template's `oven-sh/setup-bun@v2.2.0` with `bun-version: latest`. SonarCloud failed this PR on that tag-pinned third-party action ("C Security Rating"), and the runtime was unpinned. 9d13eba replaces it, on the owner's call. - `actions.lock` is unchanged from main. - One change from the template: the example in the error message now labels `actions/checkout@3d3c42e…` as v7.0.1, which is what this repository's lock records. The template says v6.0.1. ## Tested - The script passes on this branch's workflows: "all action refs are pinned". - It fails on a planted `uses: some-org/unlocked-action@v1`. - I extracted the Bun step from the workflow and ran it with a scratch `RUNNER_TEMP` whose path contains a space. The checksum printed `OK` and `bun --version` prints `1.4.2`. - standards' `validate-actions-lock.sh` (75bd599) passes on the lock. ## Merge order The owner's order is #79 → #82 → #80 → #81 → #78. This PR and #80 change different steps of the same workflow, so they don't conflict. The linter goes fully green only once both are in. scan and hypatia also need the estate re-pin to standards `75bd599`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The workflow linter installed Bun with
oven-sh/setup-bun@v2.2.0andbun-version: latest, so its runtime was unpinned. SonarCloud also gives a third-party action pinned by tag a "C" Security Rating ("Use full commit SHA hash for this dependency"), even thoughactions.lockpins its commit. hyperpolymath/network-ambulance#81 copied the step and fails its quality gate on exactly that finding. Per the owner's call, the fix goes in here first and is then ported.The linter now downloads the Bun 1.4.2 release archive (the estate pin) and checks its sha256, the way Estate Rules installs nickel, just and yq.
Changes
workflow-linter.yml: the "Set up Bun" step is replaced by "Install verified Bun 1.4.2": an HTTPS-onlycurl, thensha256sum --check --strict,unzip, and the directory appended to$GITHUB_PATH. The digest is the same one gv-clade-index's worker CI uses, and I recomputed it from the release archive.actions.lock: the linter's edge tooven-sh/setup-bun@v2.2.0is removed. Thesetup-bun@v2.2.0dependency record stays, because the commented Bun steps ine2e.yml.templatesay they resolve through it.check-lock-sync.shnotes it as unreferenced, which it calls harmless. The SHA-keyed setup-bun leaf under the standards reusables is untouched.CHANGELOG.adoc: entry under Unreleased / Changed.RSR Quality Checklist
Required
just testor equivalent): see Testingjust fmtor equivalent): not run, YAML step onlyunsafeblocks without// SAFETY:commentsbelieve_me,unsafeCoerce,Obj.magic,Admitted,sorry).envfiles includedAs Applicable
CHANGELOGor release notes updatedTesting
RUNNER_TEMPwhose path contains a space. The checksum printedOKand the step addedbun-linux-x64toGITHUB_PATH.bun --versionthere prints1.4.2, andbun scripts/check-action-pinning.jsunder it prints "all action refs are pinned".scripts/check-lock-sync.sh .github/workflowspasses, with one "unreferenced, harmless" note for the kept record.validate-actions-lock.shat75bd599passes.tests/workflows/archetype_lock_merge_test.shandtests/workflows/validate_workflows_test.shpass.scripts/check-adoc-renders.sh .passes: all 160 tracked.adocfiles render clean under asciidoctor 2.0.26.Generated by Claude Code