[praveenperera]

Pins taiki-e/create-gh-release-action (v1.11.0) and Swatinem/rust-cache (v2.9.3) to full commit SHAs, keeping the version as a trailing comment, and adds a Dependabot config that bumps GitHub Actions pins in one grouped PR each month.

Version tags such as @v1 can be moved, so a compromised upstream could change what runs in the release job, which has contents: write. A SHA pin fixes the exact code. The same change landed in aps, cln, and homebased.

Verified with actionlint; each SHA was resolved from the tag it replaces, so the actions run unchanged.

Summary by CodeRabbit

• Chores
  • Updated repository automation settings to check GitHub Actions monthly and combine matching updates into a single review.
  • Updated the CI and release workflows to use fixed versions of their actions. The release workflow continues to create draft releases.
  • These changes affect repository maintenance and release processes; no end-user functionality changed.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 191667a7-4449-456d-b04d-c91bae68b9e0

Commits

Reviewing files that changed from the base of the PR and between f6b81e2 and 154474b.

Files selected for processing: 3

• .github/dependabot.yml
• .github/workflows/ci.yml
• .github/workflows/release.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The repository adds monthly Dependabot updates for GitHub Actions and changes the CI and release workflows to reference actions by commit SHA.

Changes: GitHub Actions updates

Layer / File(s)	Summary
Action pins and update schedule .github/dependabot.yml, .github/workflows/ci.yml, .github/workflows/release.yml	Dependabot checks GitHub Actions monthly and groups matching updates under actions. The CI and release workflows replace action tags with commit SHA references.

Priority: Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: Minimal · up to 15447

No concrete merge-blocking risk is established by the supplied changes.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "Pin third-party actions to commit SHAs" matches the main change. The PR replaces mutable version tags with full commit SHAs for third-party GitHub Actions (taiki-e/create-gh-release-action …
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "Pin third-party actions to commit SHAs" matches the main change. The PR replaces mutable version tags with full commit SHAs for third-party GitHub Actions (taiki-e/create-gh-release-action in release.yml and Swatinem/rust-cache in ci.yml). It also adds a Dependabot configuration to keep those SHA pins updated. The title is specific, concise, and reflects the primary intent in the PR objectives.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}