ci: pin GitHub Actions to immutable commit SHAs - #907

🏁 Script executed:

#!/bin/bash
printf '%s\n' '--- workflow files ---'
for f in .github/workflows/npm-publish.yml .github/workflows/pr-checks-python.yml .github/workflows/pr-checks.yml .github/workflows/sync-examples.yml; do
  echo "--- $f ---"
  cat -n "$f"
done

Repository: sqlrooms/sqlrooms

Length of output: 17422

🌐 Web query:

official actions/checkout persist-credentials default documentation

💡 Result:

The default value for the persist-credentials input in the actions/checkout GitHub Action is true [1][2][3]. When persist-credentials is set to true (the default), the action configures the GITHUB_TOKEN or SSH key with the local git configuration [1][2][4]. This persistence allows subsequent steps in your workflow to execute authenticated git commands [1][4]. The token is removed during the post-job cleanup process [1][2]. To disable this behavior, you must explicitly set persist-credentials to false in your workflow file [1][2]. While there have been community discussions and pull requests proposing to change this default to false to enhance security [5][6], as of September 2026, the official documentation and the action.yml configuration continue to list the default as true [3].

Citations:

• 1: https://www.github.com/actions/checkout
• 2: https://github.com/marketplace/actions/checkout?version=v3.6.0
• 3: https://raw.githubusercontent.com/actions/checkout/v6/action.yml
• 4: https://github.com/actions/checkout/blob/0299a0d2b67d48224ce047d03c69693b37fe77fe/README.md
• 5: GitHub pull request 1687 in actions/checkout (link omitted to avoid creating a cross-reference)
• 6: GitHub issue 2312 in actions/checkout (link omitted to avoid creating a cross-reference)

🤖 get_repo_knowledge executed:

get_repo_knowledge sqlrooms/sqlrooms /tmp/coderabbit-repo-knowledge/sqlrooms-sqlrooms-cd45a147/conventions /tmp/coderabbit-repo-knowledge/sqlrooms-sqlrooms-cd45a147/learnings

Length of output: 6091

🏁 Script executed:

#!/bin/bash
for f in .github/workflows/npm-publish.yml .github/workflows/pr-checks-python.yml .github/workflows/pr-checks.yml .github/workflows/sync-examples.yml; do
  echo "--- $f ---"
  sed -n '1,220p' "$f"
done

Repository: sqlrooms/sqlrooms

Length of output: 14249

• .github/workflows/npm-publish.yml#L55-L55 (this comment)
• .github/workflows/pr-checks-python.yml#L30-L30
• .github/workflows/pr-checks.yml#L23-L23
• .github/workflows/sync-examples.yml#L28-L28

🏁 Script executed:

#!/bin/bash
printf '%s\n' '--- relevant workflow files ---'
for f in .github/workflows/pr-title.yml .github/workflows/pr-checks-python.yml .github/workflows/pr-checks.yml .github/workflows/sync-examples.yml; do
  echo "--- $f ---"
  cat -n "$f"
done
printf '%s\n' '--- workflow permission declarations ---'
rg -n -C 2 '^[[:space:]]+(permissions:|contents:|pull-requests:|actions:|checks:|packages:|id-token:|issues:|statuses:)' .github/workflows

Repository: sqlrooms/sqlrooms

Length of output: 13857

🤖 get_repo_knowledge executed:

get_repo_knowledge sqlrooms/sqlrooms /tmp/coderabbit-repo-knowledge/sqlrooms-sqlrooms-cd45a147/conventions

Length of output: 4061

🌐 Web query:

amannn/action-semantic-pull-request v6.1.1 required GITHUB_TOKEN permissions pull-requests read statuses write

💡 Result:

For amannn/action-semantic-pull-request version 6.1.1, the required GITHUB_TOKEN permissions depend on whether you are using the Work-In-Progress (WIP) feature [1][2]. 1. Standard Usage: If you are only validating the pull request title, pull-requests: read is sufficient [3]. This allows the action to fetch the pull request title via the GitHub API and determine if it adheres to your requirements [3]. 2. WIP Feature Usage: If you enable the wip feature (which keeps the PR status as "pending" while [WIP] is in the title), you must grant pull-requests: write permission [1][2]. Some users have reported that in certain workflow configurations, statuses: write may also be required to avoid "Resource not accessible by integration" errors when using the WIP feature [4][5]. While the official documentation primarily emphasizes pull-requests: write for this feature, statuses: write is a recognized fix for permission-related errors encountered during WIP status updates [4][5]. To configure this in your workflow file, you should explicitly define the permissions at the job level [1]: permissions: pull-requests: read # Required for title validation # statuses: write # Add this if you encounter errors using the WIP feature The action's main documentation recommends pull-requests: read for general use and pull-requests: write when using the WIP feature [1][2].

Citations:

• 1: https://github.com/amannn/action-semantic-pull-request
• 2: https://github.com/amannn/action-semantic-pull-request/
• 3: https://github.com/vidithq/vidit/blob/1142c772de5dd3275e4d81eb856ed1d4396c7315/.github/workflows/pr-title.yml
• 4: GitHub issue 233 in amannn/action-semantic-pull-request (link omitted to avoid creating a cross-reference)
• 5: GitHub issue 249 in amannn/action-semantic-pull-request (link omitted to avoid creating a cross-reference)

• .github/workflows/pr-title.yml#L16-L16 (this comment)
• .github/workflows/pr-checks-python.yml#L30-L30
• .github/workflows/pr-checks.yml#L23-L23
• .github/workflows/sync-examples.yml#L28-L28