Pin checkout to commit. Don't persist creds if not needed#7430
Pin checkout to commit. Don't persist creds if not needed#7430ShaharNaveh wants to merge 1 commit intoRustPython:mainfrom
Conversation
📝 WalkthroughWalkthroughGitHub Actions workflows across six configuration files are updated to pin the checkout action to a specific commit hash (v6.0.2) instead of using the floating v6 tag, while adding or modifying Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/cron-ci.yaml (1)
59-61: Consider usingpersist-credentials: falsefor these jobs.The
testdata,whatsleft, andbenchmarkjobs push to a different repository (rustpython.github.io) that's cloned separately via SSH deploy keys. The credentials from the main checkout aren't used for those push operations, sopersist-credentials: trueis unnecessary here.This is a minor optimization—the current configuration works correctly but leaves credentials persisted when they're not needed.
♻️ Optional: Use persist-credentials: false
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - persist-credentials: true + persist-credentials: falseAlso applies to: 94-96, 155-157
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/cron-ci.yaml around lines 59 - 61, Change the checkout steps that run in the testdata, whatsleft, and benchmark jobs to stop persisting the main repo credentials: locate the actions/checkout@... steps that currently have persist-credentials: true (the ones used in those three jobs) and set persist-credentials: false so the main checkout does not leave credentials available when pushes use the separately cloned rustpython.github.io SSH deploy key.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/cron-ci.yaml:
- Around line 59-61: Change the checkout steps that run in the testdata,
whatsleft, and benchmark jobs to stop persisting the main repo credentials:
locate the actions/checkout@... steps that currently have persist-credentials:
true (the ones used in those three jobs) and set persist-credentials: false so
the main checkout does not leave credentials available when pushes use the
separately cloned rustpython.github.io SSH deploy key.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: ae4406d0-a2f6-43aa-9be8-cbde3abac473
📒 Files selected for processing (6)
.github/workflows/ci.yaml.github/workflows/cron-ci.yaml.github/workflows/lib-deps-check.yaml.github/workflows/pr-format.yaml.github/workflows/release.yml.github/workflows/update-doc-db.yml
1 participant
Summary by CodeRabbit