ci: pin shared action dependencies - #45
Merged
Merged
Conversation
rianjs
marked this pull request as ready for review
September 15, 2026 15:35
rianjs
added a commit
to open-cli-collective/codereview-cli
that referenced
this pull request
Sep 15, 2026
## Problem The CLI duplicated terminal editor and architecture mechanics, had unreachable init state, and left runtime and CI defaults dependent on mutable or one-time configuration. ## Changes - Bound the GitLab HTTP client and add cancellation/cascade coverage alongside the SQLite startup fix merged from main. - Remove unreachable secrets-editor state and brittle architecture prescriptions; fix eight cleanup registrations while keeping dependency and lifecycle boundaries. - Share the pinned Bubbles input/textarea components across init editors, preserve staged writes and secret masking, and wrap terminal text by ANSI cell width. - Migrate direct YAML use to maintained `go.yaml.in/yaml/v3` v3.0.5. - Pin codereview workflow dependencies to full commit SHAs, including the shared automation commit `b6382514b809d960c6fbdc85745a60c14cde04f1`. The shared automation pin is prepared in [open-cli-collective/.github#45](open-cli-collective/.github#45), which pins its nested action graph and validates the new self-repository references. ## Validation - `make build` passed from the committed tree. - `make test` passed across the full repository. - `make lint` passed with 0 issues. - `go mod verify` passed. - `actionlint` passed for the caller workflows. - All caller action references were audited as full 40 character SHAs and the shared reference was checked against PR #45's head OID. - Built binary `--version`/`--help` smoke tests passed; the temporary-config PTY smoke covered init navigation, staging, back, and discard without real credentials.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Shared workflows and composites used moving action tags, and nested shared actions used
@v1, so a caller pinned to a commit could still execute a different nested action revision.Changes
$/actions/..., which resolves them from the exact shared commit running the reusable workflow.pr-titleintegration cases.The selected action revisions use the Node 24 runtime. The self-repository syntax requires Actions runner 2.336.0 or newer. The commit-to-tag mapping and source checks are recorded in
/tmp/codereview-shared-workflow-review-evidence.mdduring review.Validation
make build,make test, andmake lintpassed; committed fixture binary smoke passed.git diff --checkpassed.The installed actionlint 1.7.12 does not yet recognize GitHub's documented
$/actions/...syntax and reports those references as invalid; it reports no other diagnostics.