[yocaba]

What

update-action-pins.yml fails a PR when a pin's SHA changes but its version comment doesn't, or when a pin's comment is anything but # <version>, and dev-kit's pin comments now name full release tags.

Part of #47

Why

A pin whose SHA changes under the same version comment means upstream moved the tag, or the PR swapped the SHA. That is how a compromised tag reaches a digest update, and zizmor's audits don't catch it, since the moved tag still matches the comment. Full release tags (# v7.0.1) keep the check quiet on legitimate updates; a major tag (# v7) moves with every release.

zizmor's ref-version-mismatch audit only checks a pin whose comment is exactly # <version>. Without a comment, or with any text after the version (a # zizmor: ignore[...] included), it skips the pin without a finding.

Testing

• scripts/test-update-action-pins.sh runs the new steps from the workflow file
• The comment step passes on dev-kit, solution-arsenal, artifact-conduit, apiserver-kit and renovate-config
• Run against chore(deps): update dependencies (patch & digest) #60, the step flags both digest moves in it: release-drafter # v7 and cachix-action # v17

Notes for reviewers

• Consumers with # vN comments see their next digest update fail until the comments name the full tag pointing at the same SHA (git ls-remote --tags lists them).
• No # zizmor: ignore[...] can sit on a pin line anymore; the zizmor workflow for Check GitHub Action pins for impostor and mismatched commits in CI #47 won't honor ignores either.
• cachix/cachix-action publishes only major tags and moves v17, so each of its digest updates needs a human review and an admin merge.

Checklist

• Tests added/updated, or confirmed that no tests are required
• No breaking changes, or upgrade path documented above
• Readable commit history (squashed and cleaned up as desired)
• AI code review considered and comments resolved

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3ce9d87d-53a8-487c-a4ca-29bc828bdeb6

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}