Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/test-cli-generic.yml
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:

- name: Generate Release Notes (Generic)
id: notes
uses: desktop/copilot-release-notes@main
uses: github/copilot-release-notes@main

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow pins this action to the main branch. For supply-chain security and reproducibility, consider pinning github/copilot-release-notes to a tagged release or a full commit SHA instead of a moving branch.

Suggested change
uses: github/copilot-release-notes@main
uses: github/copilot-release-notes@v1.0.0

Copilot uses AI. Check for mistakes.
with:
base-ref: ${{ inputs.base-ref }}
head-ref: ${{ inputs.head-ref }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-cli.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,13 +30,13 @@ jobs:
- name: Checkout instructions file
uses: actions/checkout@v4
with:
repository: desktop/copilot-release-notes
repository: github/copilot-release-notes
path: _action-config
sparse-checkout: cli-release-notes-instructions.md
Comment on lines +33 to 35

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout is pulling instruction content from the default branch of github/copilot-release-notes. To keep these tests deterministic (and reduce supply-chain risk), consider pinning the checkout to an explicit ref (tag or commit SHA).

This issue also appears on line 39 of the same file.

See below for a potential fix:

          ref: v1
          path: _action-config
          sparse-checkout: cli-release-notes-instructions.md

      - name: Generate Release Notes (CLI Style)
        id: notes
        uses: github/copilot-release-notes@v1

Copilot uses AI. Check for mistakes.

- name: Generate Release Notes (CLI Style)
id: notes
uses: desktop/copilot-release-notes@main
uses: github/copilot-release-notes@main
with:
base-ref: ${{ inputs.base-ref }}
head-ref: ${{ inputs.head-ref }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-custom.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,13 +30,13 @@ jobs:
- name: Checkout instructions file
uses: actions/checkout@v4
with:
repository: desktop/copilot-release-notes
repository: github/copilot-release-notes
path: _action-config
sparse-checkout: release-notes-guide.md
Comment on lines +33 to 35

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout is pulling instruction content from the default branch of github/copilot-release-notes. To keep these tests deterministic (and reduce supply-chain risk), consider pinning the checkout to an explicit ref (tag or commit SHA).

This issue also appears on line 39 of the same file.

See below for a potential fix:

          ref: v1.7.1
          path: _action-config
          sparse-checkout: release-notes-guide.md

      - name: Generate Release Notes (Custom Instructions)
        id: notes
        uses: github/copilot-release-notes@v1.7.1

Copilot uses AI. Check for mistakes.

- name: Generate Release Notes (Custom Instructions)
id: notes
uses: desktop/copilot-release-notes@main
uses: github/copilot-release-notes@main
with:
base-ref: ${{ inputs.base-ref }}
head-ref: ${{ inputs.head-ref }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:

- name: Generate Release Notes
id: notes
uses: desktop/copilot-release-notes@main
uses: github/copilot-release-notes@main

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow pins this action to the main branch. For supply-chain security and reproducibility, consider pinning github/copilot-release-notes to a tagged release or a full commit SHA instead of a moving branch.

Suggested change
uses: github/copilot-release-notes@main
uses: github/copilot-release-notes@v1.6.5

Copilot uses AI. Check for mistakes.
with:
base-ref: ${{ inputs.base-ref }}
head-ref: ${{ inputs.head-ref }}
Expand Down
Loading