From a9a29149856e6e018bc2aa0c91344248cc29b08a Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 22 Jun 2026 10:30:08 +0100 Subject: [PATCH 1/3] Don't mark the PR as a draft in the `rebuild` workflow --- .github/workflows/rebuild.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index b8e8d490..cc60ffe2 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -34,7 +34,7 @@ jobs: uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 - cache: 'npm' + cache: "npm" - name: Remove label if: github.event_name == 'pull_request' @@ -133,4 +133,3 @@ jobs: echo "Pushed a commit to rebuild the Action." \ "Please mark the PR as ready for review to trigger PR checks." | gh pr comment --body-file - --repo github/codeql-variant-analysis-action "$PR_NUMBER" - gh pr ready --undo --repo github/codeql-variant-analysis-action "$PR_NUMBER" From f7dd24d583eb77d440cf24ab64382b20b4c3fbab Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 22 Jun 2026 10:34:36 +0100 Subject: [PATCH 2/3] Pin SHAs --- .github/workflows/codeql-analysis.yml | 6 +++--- .github/workflows/pr-checks.yml | 29 +++++++++++++++++---------- .github/workflows/rebuild.yml | 2 +- 3 files changed, 22 insertions(+), 15 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 91b08553..4f217a23 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -20,15 +20,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: config-file: ./.github/codeql/codeql-config.yml languages: "javascript" queries: security-and-quality - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index c9ce5ada..a0b2a12c 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -11,8 +11,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "24.x" cache: "npm" @@ -25,13 +26,16 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "24.x" cache: "npm" + - name: Install dependencies run: npm ci + - name: Check generated JavaScript run: .github/workflows/script/check-js.sh @@ -39,8 +43,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "24.x" cache: "npm" @@ -53,8 +58,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "24.x" cache: "npm" @@ -71,18 +77,19 @@ jobs: runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "24.x" cache: "npm" + - name: Install dependencies run: npm ci - name: Initialize CodeQL id: init - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: languages: javascript diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index cc60ffe2..921b5792 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 ref: ${{ env.HEAD_REF }} From 442011af696df1bc0fd858cd45eb3bff7c2f2a1a Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 22 Jun 2026 12:33:55 +0100 Subject: [PATCH 3/3] Update .github/workflows/rebuild.yml Co-authored-by: Henry Mercer --- .github/workflows/rebuild.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index 921b5792..68b1c351 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -131,5 +131,5 @@ jobs: PR_NUMBER: ${{ github.event.pull_request.number }} run: | echo "Pushed a commit to rebuild the Action." \ - "Please mark the PR as ready for review to trigger PR checks." | + "Please approve running the PR checks." | gh pr comment --body-file - --repo github/codeql-variant-analysis-action "$PR_NUMBER"