mirror of
https://github.com/alibaba/open-code-review.git
synced 2026-08-21 06:34:29 +00:00
7e52a4fd55
Some checks are pending
CI / cross-compile (amd64, darwin) (push) Waiting to run
CI / cross-compile (amd64, windows) (push) Waiting to run
CI / cross-compile (arm64, darwin) (push) Waiting to run
CI / test (push) Waiting to run
Deploy Pages / build (push) Waiting to run
CI / cross-compile (arm64, linux) (push) Waiting to run
CI / cross-compile (arm64, windows) (push) Waiting to run
CodeQL Advanced / Analyze (actions) (push) Waiting to run
CodeQL Advanced / Analyze (go) (push) Waiting to run
CodeQL Advanced / Analyze (javascript-typescript) (push) Waiting to run
Deploy Pages / deploy (push) Blocked by required conditions
* fix(action): pin nested action references to full commit SHAs A consumer who SHA-pins alibaba/open-code-review still ran whatever the floating actions/* tags inside action.yml pointed at, so the outer pin did not actually freeze the workflow. Pin all four nested references to full commit SHAs with a trailing version comment, enforce the invariant with scripts/verify-action-pins.sh in CI, and document the dual pin (action SHA + ocr_version) that reproducible setups need. Refs #816 * fix(scripts): fail the pin check when action.yml is missing |
||
|---|---|---|
| .. | ||
| github-actions | ||
| publish | ||
| add-license.sh | ||
| install.js | ||
| platform.js | ||
| update.js | ||
| verify-action-pins.sh | ||
| verify-license.sh | ||