feat: Use full commit SHA hash for dependency #99
Conversation
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@ ## main #99 +/- ## ======================================= Coverage 94.48% 94.48% ======================================= Files 3 3 Lines 145 145 ======================================= Hits 137 137 Misses 8 8 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
WalkthroughPinned GitHub Actions in two workflows from version tags to exact commit SHAs: .github/workflows/codspeed.yml and .github/workflows/test.yml. No other workflow logic or steps changed. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Assessment against linked issues
Assessment against linked issues: Out-of-scope changes(no out-of-scope functional changes identified) Possibly related issues
Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File ( |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (5)
.github/workflows/test.yml (3)
18-18: Good pin; add checkout hardening (persist-credentials).Pinning to a full SHA is the right security move. Also prevent leaving GITHUB_TOKEN in the repo’s origin URL.
Apply:
- name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5 + with: + persist-credentials: false
21-21: Good pin; enable pip cache for speed.Apply:
- name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5 with: python-version: ${{ matrix.python-version }} allow-prereleases: true + cache: pip + cache-dependency-path: pyproject.toml
36-36: Add minimal default permissions to the workflow
- In
.github/workflows/test.yml, at the top level add:permissions: contents: read- (Optional) To prepare for tokenless OIDC in the future, you can also include:
permissions: id-token: write.github/workflows/codspeed.yml (2)
29-30: Good pins; mirror checkout hardening and pip cache.Apply:
- - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5 + with: + persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5 + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 #v5 with: python-version: "3.13" + cache: pip + cache-dependency-path: pyproject.toml
38-38: Good pin; add least-privilege and cancel in-progress runs.Keep tokens tight and save CI minutes on rapid pushes.
Apply at workflow root:
name: CodSpeed + +permissions: + contents: read + +concurrency: + group: codspeed-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/codspeed.yml(1 hunks).github/workflows/test.yml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: test (3.9)
- GitHub Check: test (3.14)
- GitHub Check: Run benchmarks
CodSpeed Performance ReportMerging #99 will not alter performanceComparing Summary
|
1 participant
closes #98
Summary by CodeRabbit