Repository navigation
test(ci): require full-commit Action pins instead of exact commits - #5
Merged
Merged
Conversation
The retention policy test asserted the exact upload-artifact and dependency-review-action commits, so every Dependabot Action update failed it. Require a full 40-character commit pin instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U2FYdqSaYi8WtMzzgseAMh
Dependency Review✅ No vulnerabilities or license issues found.Scanned FilesNone |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc4f408c64
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Anchor the pin regex after the 40-hex commit so a movable ref such as <sha>-moving no longer satisfies the full-commit assertion. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U2FYdqSaYi8WtMzzgseAMh
zoeyrose
added a commit
to atrinik/atrinik
that referenced
this pull request
Oct 16, 2026
## Summary Follow-up to #653. That PR changed `tests/test_dependency_report_retention.py` to require a full-commit pin with `@[0-9a-f]{40}\b`. Because `\b` matches before a hyphen, a movable ref that merely starts with 40 hex characters, such as `actions/upload-artifact@<sha>-moving`, still passed. Codex found the same gap in the copy of this test in atrinik/agent-integrations#5. ## Implementation / behavior Both assertions now use `@[0-9a-f]{40}(?=[ \t\r\n]|$)`, so only a space, tab, CR, LF or the end of the value may follow the commit. An earlier version of this PR used `\s`, which in Python also matches Unicode whitespace such as U+00A0. YAML keeps that character inside the scalar, so `<sha><U+00A0>moving` would have passed. The workflow and its pins are unchanged. The supply-chain audit already full-matches each workflow ref against `^[0-9a-f]{40}$`, so it isn't affected. ## Validation - `python3 -m unittest tests.test_dependency_report_retention`: 15 tests pass. - These pass the new pattern: the current `dependency-review.yml`, a pin followed by a space or tab comment, LF, CRLF or the end of the file. - These are rejected: `<sha>-moving`, `<sha>` followed by U+00A0 or U+2003, `<sha>#x`, and `@v7`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01U2FYdqSaYi8WtMzzgseAMh --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tests/test_dependency_report_retention.pyasserted the exactupload-artifactanddependency-review-actioncommits in the dependency review workflow. That makes every Dependabot Action update fail this test until someone edits it by hand. The test now requires a full 40-character commit pin for both Actions instead.Implementation / behavior
Two assertions change from
assertInwith a fixed commit toassertRegexwith@[0-9a-f]{40}(?=\s|$). The workflow and its pins are unchanged. Because whitespace or the end of the value must follow the commit, the test still fails if either Action is pinned to a tag or branch, including a ref that only starts with 40 hex characters, such as<sha>-moving.This matches the change to the same test in atrinik/atrinik#653, which is already merged.
Validation
python3 -m unittest tests.test_dependency_report_retentionpasses locally.<sha>-moving,<sha>xand@v7, which fail.🤖 Generated with Claude Code
https://claude.ai/code/session_01U2FYdqSaYi8WtMzzgseAMh