Skip to content

fix: checkout action scripts at called reusable workflow SHA - #10

Merged
codemod-com-bot merged 1 commit into
mainfrom
fix/reusable-workflow-checkout-sha
Oct 31, 2026
Merged

codemod-com-bot merged 1 commit into
mainfrom
fix/reusable-workflow-checkout-sha

Conversation

@alexbit-codemod

Copy link
Copy Markdown
Contributor

Summary

  • Fork (and same-repo reusable) reviews failed on Checkout Azure endpoint normalizer with fatal: upload-pack: not our ref <caller-sha> because github.workflow_sha is the caller commit, not the pinned reusable workflow.
  • Check out codemod/codex-review-action with job.workflow_repository / job.workflow_sha instead, matching GitHub’s reusable-workflow identity context.
  • Add a regression test so the normalizer step cannot drift back to github.workflow_sha.

Seen in: https://github.com/codemod/react-codemod/actions/runs/41239358110/job/124649854598

Test plan

  • node --test tests/fork-review.test.cjs
  • Merge, let sync-action-pins open draft pin bumps for consumers (react-codemod, codemod, codemod-app, arc-codemods)
  • Merge a consumer pin PR, then re-run /codex-review on a fork PR

Made with Cursor

github.workflow_sha is the caller commit, so fork reviews failed fetching
that SHA from codemod/codex-review-action. Use job.workflow_* instead.

Co-authored-by: Cursor <cursoragent@cursor.com>
@codemod-com-bot
codemod-com-bot merged commit cab4995 into main Oct 31, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants