ci: align actions/checkout on the v4.3.1 standard pin by dezren39 · Pull Request #170 · developing-today/opencode

dezren39 · 2026-10-20T10:41:56Z

Problem

#160's remainder: after PR #161 retired checkout v3.6.0 and PR #165 made github-script uniform at v8.0.0, actions/checkout was still pinned at two majors on main 1ed7398e10:

34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 — 38 sites
de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 — 2 sites: nix-eval.yml:29 and nix-hashes.yml:51 (the latter mixing two majors in one file, since its second checkout at :107 is already v4.3.1)

Solution / standard chosen

Standard: v4.3.1 (34e114876b0b11c390a56381ad16ebd13914f8d5), the pin PR #161 already established as the repo standard when it moved the 16 deploy/publish v3.6.0 sites onto it. Aligning the 2 outliers down is a 2-line change; moving all 38 sites up to v6.0.2 would be a much larger, separately-motivated bump.

Both v6.0.2 sites are bare checkouts with no with: block, so no v6-only input is in use; the v4.3.1 checkout in the same nix-hashes.yml file already uses persist-credentials / fetch-depth / ref, all supported by v4.3.1.

This PR changes exactly those 2 lines (nix-eval.yml, nix-hashes.yml compute-hash job). No with: inputs touched.

Verification

Post-change enumeration: 40/40 actions/checkout uses are the single v4.3.1 SHA pin; zero v6.0.2 (and zero v3.6.0) remain.
actions/github-script already uniform: 4/4 at v8.0.0 (PR ci: pin actions/github-script at v8.0.0 everywhere (#164) #165) — untouched.
All 31 workflow files parse as YAML.
Acceptance leg: this PR triggers nix-eval itself (pull_request to main), which runs its checkout step under the newly aligned pin.

Closes #160

Origin issue: #160 — single-repo (sibling repos checked in the issue: nix uniform v7.0.1, openchamber uniform, code floats tags), so no downstream port is owed.

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

Chores
- Updated repository checkout tooling used by automated workflows.
- Workflows now use a pinned, earlier checkout action version for consistent execution.

github-actions · 2026-10-20T10:42:07Z

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 72 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

chatgpt-codex-connector · 2026-10-20T10:42:08Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T10:43:13.553540Z	`4a74b94`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions · 2026-10-20T10:42:17Z

Hey! Your PR title ci: align actions/checkout on the v4.3.1 standard pin doesn't follow conventional commit format.

Please update it to start with one of:

feat: or feat(scope): new feature
fix: or fix(scope): bug fix
docs: or docs(scope): documentation changes
chore: or chore(scope): maintenance tasks
refactor: or refactor(scope): code refactoring
test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, opencode).

See CONTRIBUTING.md for details.

coderabbitai · 2026-10-20T10:42:19Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 9213c849-2d81-4d35-973e-9c3fe339a359

📥 Commits

Reviewing files that changed from the base of the PR and between 1ed7398 and 4a74b94.

📒 Files selected for processing: 2

.github/workflows/nix-eval.yml
.github/workflows/nix-hashes.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Both Nix GitHub Actions workflows now reference actions/checkout v4.3.1, pinned to its specified commit, instead of v6.0.2.

Changes: Nix workflow checkout pins

Layer / File(s)	Summary
Update checkout pins `.github/workflows/nix-eval.yml`, `.github/workflows/nix-hashes.yml`	Both workflows now use the pinned `actions/checkout` v4.3.1 reference.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: jerome-benoit

Merge Risk: ⚪ Minimal · up to 4a74b

The checkout pin alignment is ready to merge; no actionable risk was found.

Pre-merge checks: 4 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		Issue `#160` requires one SHA-pinned `actions/checkout` version with an accurate comment, one `actions/github-script` pin, valid YAML, and a green PR-triggered workflow using the selected checkout pin. …	Provide CI evidence that the PR-triggered workflow using the selected checkout pin completed successfully.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: standardizing the actions/checkout pin to v4.3.1.
Description check		The description explains the issue, selected solution, exact files changed, rationale, verification steps, and linked issue. It does not use every template heading and omits the explicit type-of-chang…
Out of Scope Changes check		The whole-PR diff contains only the two checkout-pin changes required by issue `#160`: `nix-eval.yml` and the compute-hash job in `nix-hashes.yml`. The changes do not modify workflow inputs or unrelated…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Description check

Explanation

The description explains the issue, selected solution, exact files changed, rationale, verification steps, and linked issue. It does not use every template heading and omits the explicit type-of-change and checklist sections, but it provides the required core information and is mostly complete.

Full details: Out of Scope Changes check

Explanation

The whole-PR diff contains only the two checkout-pin changes required by issue #160: nix-eval.yml and the compute-hash job in nix-hashes.yml. The changes do not modify workflow inputs or unrelated actions.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Linked Issues check

Explanation

Issue #160 requires one SHA-pinned actions/checkout version with an accurate comment, one actions/github-script pin, valid YAML, and a green PR-triggered workflow using the selected checkout pin. The whole-PR diff changes the two remaining checkout references to 34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1. The PR description reports 40/40 checkout uses, 4/4 actions/github-script uses, and valid YAML. nix-eval.yml has a pull_request trigger and uses the selected pin. The available evidence does not establish that the PR-triggered workflow completed green.

Resolution

Provide CI evidence that the PR-triggered workflow using the selected checkout pin completed successfully.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-20T10:42:49Z

The following comment was made by an LLM, it may be inaccurate:

ci: align actions/checkout on the v4.3.1 standard pin

4a74b94

github-actions Bot added the needs:compliance label Oct 20, 2026

github-actions Bot added the needs:title label Oct 20, 2026

dezren39 merged commit fdafdd8 into main Oct 20, 2026
17 of 19 checks passed

dezren39 deleted the sweep/160-checkout-standard branch October 20, 2026 10:46

Navigation Menu

Repository navigation

ci: align actions/checkout on the v4.3.1 standard pin - #170

ci: align actions/checkout on the v4.3.1 standard pin#170
dezren39 merged 1 commit into
mainfrom
sweep/160-checkout-standard

dezren39 commented Oct 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dezren39 commented Oct 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution / standard chosen

Verification

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

coderabbitai Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dezren39 commented Oct 20, 2026 •

edited by coderabbitai Bot

Loading

chatgpt-codex-connector Bot commented Oct 20, 2026 •

edited

Loading

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading