Cleanup release.yml a bit#7499
Conversation
release.yml a bitrelease.yml a bit
📝 WalkthroughWalkthroughThe release workflow in Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You can see a successful run of this CI at https://github.com/ShaharNaveh/RustPython/actions/runs/23482819851/job/68330699653 |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
140-140: Consider pinningpeaceiris/actions-gh-pagesto a SHA for consistency.Other actions in this workflow are pinned to commit SHAs, but this one uses
@v4. For supply-chain security consistency, consider pinning to a specific commit hash.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release.yml at line 140, The workflow currently uses peaceiris/actions-gh-pages@v4 without a commit SHA; update the uses entry for peaceiris/actions-gh-pages (the line referencing "peaceiris/actions-gh-pages@v4") to a pinned commit by replacing `@v4` with the corresponding full commit SHA (e.g., @<sha>) to match the other actions’ pinning strategy; retrieve the latest stable commit SHA for the v4 release from the action’s GitHub repository and update the workflow so the uses field references that SHA.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/release.yml:
- Line 140: The workflow currently uses peaceiris/actions-gh-pages@v4 without a
commit SHA; update the uses entry for peaceiris/actions-gh-pages (the line
referencing "peaceiris/actions-gh-pages@v4") to a pinned commit by replacing `@v4`
with the corresponding full commit SHA (e.g., @<sha>) to match the other
actions’ pinning strategy; retrieve the latest stable commit SHA for the v4
release from the action’s GitHub repository and update the workflow so the uses
field references that SHA.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 4f2b5d1d-8f75-494e-a0f8-eb26b2122255
📒 Files selected for processing (1)
.github/workflows/release.yml
release.yml a bitrelease.yml a bit
Behavior changes
stdio,hoat_envandssl-rustlsfeatures on macos, windows, linuxOther changes
Summary by CodeRabbit