ci: consolidate action pins — one SHA per action, no moving tags - #49
Open
noahgift wants to merge 1 commit into
Open
ci: consolidate action pins — one SHA per action, no moving tags#49noahgift wants to merge 1 commit into
noahgift wants to merge 1 commit into
Conversation
The fleet asks GitHub for SIX different `actions/checkout` refs, and each one is a separate cache entry on each of 16 runners. Measured 2026-08-17: @v7 (tag) 31 uses -> v7.0.1 today @df4cb1c0… 20 -> v6.0.3 @de0fac2e… 13 -> v6.0.2 @v6, @v5 (tags) 4 @34e11487… THIS FILE 6 -> v4.3.1 16 runners x 6 refs is ~96 downloads of one action, which is why CI spent the afternoon failing on Failed to download action 'https://codeload.github.com/actions/checkout/...' 429 (Too Many Requests) ... after 3 attempts That is NOT an API rate limit — `gh api rate_limit` read core 106/5000 and graphql 0/5000 at the time. codeload is a different endpoint with no published limit, so being inside the documented budget and being 429'd are both true at once. The amplification is ours. This file is the highest-leverage single place: every repo consumes it, and it was pinning the OLDEST checkout in the fleet — v4.3.1, three majors behind. actions/checkout 34e11487 (v4.3.1) -> 3d3c42e5 (v7.0.1) actions/upload-artifact @v4 (moving tag) -> ea165f8d (v4.6.2) v7.0.1 is not a leap into the unknown: 31 uses across the fleet already run `@v7`, which resolves to exactly this commit today and passes. For those it is a no-op that removes a moving tag; for this file it is the upgrade it had been missing. No moving tags remain in this workflow. A moved tag is both a re-download and an unaudited change, so pinning is a supply-chain fix as much as a bandwidth one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fleet asks GitHub for six different
actions/checkoutrefs, and each is a separate cache entry on each of 16 runners. Measured 2026-08-17:@v7(tag)@df4cb1c0…@de0fac2e…@v6,@v5(tags)@34e11487…← this file16 runners × 6 refs ≈ 96 downloads of one action, which is why CI spent the afternoon failing on:
This is not an API rate limit
gh api rate_limitread core 106/5000, graphql 0/5000 while it was happening.codeload.github.comis a different endpoint with no published limit — so "we're inside our documented budget" and "we're being 429'd" are both true simultaneously, and nothing inrate_limitwill ever show it. The amplification is ours.Why this file first
Every repo consumes it, and it was pinning the oldest checkout in the fleet — v4.3.1, three majors behind everything else.
v7.0.1 is not a leap into the unknown: 31 uses across the fleet already run
@v7, which resolves to exactly this commit today and passes. For those it becomes a no-op that removes a moving tag; for this file it is the upgrade it had been missing.Supply chain, not just bandwidth
No moving tags remain in this workflow. A moved tag is both a re-download and an unaudited change.
Follow-up
Per-repo pins still need consolidating onto the same SHA — mechanical, sequenced after the open dependabot bumps rather than colliding with them.
A shared runner-level cache (
ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE, confirmed present in runner 2.336.0) would remove the 16× multiplier too, but its seeding convention isn't recoverable from the binary and needs an empirical test first.🤖 Generated with Claude Code