ci: align workflows, fix CI detection, merge dependency updates #12
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -52,14 +52,14 @@ jobs: | |
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Install Rust stable | ||
| uses: dtolnay/rust-toolchain@stable | ||
|
|
||
| # Cache cargo registry and build artifacts for faster runs | ||
| - name: Cache cargo registry | ||
| uses: actions/cache@v5 | ||
| with: | ||
|
Comment on lines
+55
to
63
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: # First, check if the workflow file exists and get its size
wc -l .github/workflows/mutation.yml 2>/dev/null || echo "File not found"Repository: EffortlessMetrics/lintdiff Length of output: 104 🏁 Script executed: # Read the specific lines mentioned in the review
echo "=== Lines 55-63 ==="
sed -n '55,63p' .github/workflows/mutation.yml 2>/dev/null || echo "File not found"
echo -e "\n=== Lines 263-272 ==="
sed -n '263,272p' .github/workflows/mutation.yml 2>/dev/null || echo "File not found"Repository: EffortlessMetrics/lintdiff Length of output: 803 🏁 Script executed: # Search for all 'uses:' entries in the workflow to see the pattern
echo "=== All action references in mutation.yml ==="
grep -n "uses:" .github/workflows/mutation.yml 2>/dev/null || echo "File not found"Repository: EffortlessMetrics/lintdiff Length of output: 321 🌐 Web query:
💡 Result: GitHub Actions security best practices strongly recommend pinning actions to a full-length commit SHA for immutability and protection against supply chain attacks. This prevents malicious updates to tags or branches. Key practices: - Pin to full SHA: uses: actions/checkout@692973e (Verify SHA from official repo, not forks). - Add comment for readability and Dependabot: # v4.1.0 - Use for third-party actions, especially high-risk ones handling secrets. - Avoid Citations:
Pin these action upgrades to immutable commit SHAs. These Applies to lines 55, 62, 263, and 272. 🤖 Prompt for AI Agents |
||
| path: | | ||
| ~/.cargo/registry | ||
|
|
@@ -260,7 +260,7 @@ jobs: | |
|
|
||
| # Upload mutation reports as artifacts | ||
| - name: Upload mutation reports | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: mutation-reports | ||
| path: mutants-out/ | ||
|
|
@@ -269,7 +269,7 @@ jobs: | |
| # Create GitHub issue if mutation score drops below threshold | ||
| - name: Create issue for low mutation score | ||
| if: steps.aggregate.outputs.overall_score < env.MUTATION_THRESHOLD && github.event_name == 'schedule' | ||
| uses: actions/github-script@v8 | ||
| with: | ||
| script: | | ||
| const score = '${{ steps.aggregate.outputs.overall_score }}'; | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧹 Nitpick | 🔵 Trivial
Centralize the deprecated crate inventory.
The same crate names and existence checks are now duplicated across build, check, and warning steps. The next rename or removal will require touching several places again, so this workflow is still prone to drift. Consider defining the manifest-path list once and iterating over it.
Also applies to: 48-62, 82-85, 117-120, 151-154
🤖 Prompt for AI Agents