chore: pin github actions to sha hashes#7172
Conversation
yasnagat
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (3)
WalkthroughMultiple GitHub Actions workflows and composite actions were updated to pin third-party action references to specific commit SHAs (with inline version comments). No workflow logic, inputs, step conditions, paths, or build commands were changed. Several files also had trailing newlines normalized. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested labelstype: chore 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/actions/build-ios/action.yml (1)
81-81:⚠️ Potential issue | 🟡 MinorPre-existing: unquoted secret in shell command.
Not introduced by this PR, but
echo ${{ inputs.APP_STORE_CONNECT_API_KEY_BASE64 }} | base64 --decodeinterpolates the secret unquoted into the shell and also echoes it (logs redact but it's fragile). Consider piping via env +printenv. Flagging for awareness; not blocking this chore PR.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/actions/build-ios/action.yml at line 81, The line echo ${{ inputs.APP_STORE_CONNECT_API_KEY_BASE64 }} | base64 --decode > ./ios/fastlane/app_store_connect_api_key.p8 exposes and unquotes a secret; change it to avoid unquoted interpolation by first exporting the input to an environment variable and then piping that environment variable through a safe reader (e.g., use printenv) into base64 --decode to write ./ios/fastlane/app_store_connect_api_key.p8, or alternatively use a safe, quoted write via printf with a quoted variable expansion; locate the offending command in action.yml to update the shell invocation accordingly..github/workflows/e2e-build-android.yml (1)
26-97:⚠️ Potential issue | 🔴 CriticalFix incorrect SHA for gradle/actions/setup-gradle action.
The
gradle/actions/setup-gradleaction is pinned to an incorrect SHA. The workflow specifiesed408507eac070d1f99cc633dbcf757c94c7933afor v4.4.3, but the correct SHA is48b5f213c81028ace310571dc5ec0fbbca0b2947. Update this SHA before merging.The other pinned actions (
actions/setup-javav4.8.0 andandroid-actions/setup-androidv3.2.2) have correct SHAs.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/e2e-build-android.yml around lines 26 - 97, Update the pinned SHA for the Gradle setup action: replace the incorrect SHA used in the uses entry "gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a" with the correct SHA "48b5f213c81028ace310571dc5ec0fbbca0b2947" (keeping the v4.4.3 tag) so the setup step "Set up Gradle" references the correct commit.
🧹 Nitpick comments (1)
.github/actions/upload-android/action.yml (1)
56-56: Optional: add aname:to this step for consistency.All other
uses:steps in this composite include aname:; this one does not. Not blocking.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/actions/upload-android/action.yml at line 56, Add a missing name for the download-artifact step: locate the step with uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 in the composite action and add a descriptive name: field (e.g., name: "Download artifact") above the uses: line to match the style of the other steps and improve consistency.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In @.github/actions/build-ios/action.yml:
- Line 81: The line echo ${{ inputs.APP_STORE_CONNECT_API_KEY_BASE64 }} | base64
--decode > ./ios/fastlane/app_store_connect_api_key.p8 exposes and unquotes a
secret; change it to avoid unquoted interpolation by first exporting the input
to an environment variable and then piping that environment variable through a
safe reader (e.g., use printenv) into base64 --decode to write
./ios/fastlane/app_store_connect_api_key.p8, or alternatively use a safe, quoted
write via printf with a quoted variable expansion; locate the offending command
in action.yml to update the shell invocation accordingly.
In @.github/workflows/e2e-build-android.yml:
- Around line 26-97: Update the pinned SHA for the Gradle setup action: replace
the incorrect SHA used in the uses entry
"gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a" with the
correct SHA "48b5f213c81028ace310571dc5ec0fbbca0b2947" (keeping the v4.4.3 tag)
so the setup step "Set up Gradle" references the correct commit.
---
Nitpick comments:
In @.github/actions/upload-android/action.yml:
- Line 56: Add a missing name for the download-artifact step: locate the step
with uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 in
the composite action and add a descriptive name: field (e.g., name: "Download
artifact") above the uses: line to match the style of the other steps and
improve consistency.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5398bb7f-55a8-49c3-99a9-385dea9493d6
📒 Files selected for processing (19)
.github/actions/build-android/action.yml.github/actions/build-ios/action.yml.github/actions/fetch-supported-versions/action.yaml.github/actions/setup-node/action.yml.github/actions/upload-android/action.yml.github/actions/upload-internal-android/action.yml.github/actions/upload-ios/action.yml.github/workflows/build-android.yml.github/workflows/build-ios.yml.github/workflows/build-official-android.yml.github/workflows/build-official-ios.yml.github/workflows/e2e-build-android.yml.github/workflows/e2e-build-ios.yml.github/workflows/eslint.yml.github/workflows/generate-changelog.yml.github/workflows/maestro-android.yml.github/workflows/maestro-ios.yml.github/workflows/organize_translations.yml.github/workflows/prettier.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: ESLint and Test / run-eslint-and-test
🧰 Additional context used
🧠 Learnings (2)
📚 Learning: 2026-02-26T10:48:56.700Z
Learnt from: Rohit3523
Repo: RocketChat/Rocket.Chat.ReactNative PR: 7008
File: .github/workflows/maestro-ios.yml:90-93
Timestamp: 2026-02-26T10:48:56.700Z
Learning: In the Rocket.Chat.ReactNative repository's Maestro iOS workflow (.github/workflows/maestro-ios.yml), the `retry_on: timeout` configuration is intentionally used instead of `retry_on: any` because test failures are handled within the .github/scripts/run-maestro.sh script itself. Workflow-level retries should only occur when Maestro hangs (timeout), not on test failures.
Applied to files:
.github/workflows/maestro-android.yml.github/workflows/maestro-ios.yml
📚 Learning: 2026-04-07T17:49:17.538Z
Learnt from: CR
Repo: RocketChat/Rocket.Chat.ReactNative PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-04-07T17:49:17.538Z
Learning: Run yarn prettier-lint and TZ=UTC yarn test for modified files before committing
Applied to files:
.github/workflows/eslint.yml
🔇 Additional comments (19)
.github/workflows/prettier.yml (1)
19-19: Pinned checkout reference is consistent.The SHA pin and
# v4.3.1comment follow the same convention used elsewhere, and the changed push line does not alter behavior.Also applies to: 50-50
.github/workflows/build-ios.yml (1)
30-30: Both checkout pins look correct.The build and upload jobs consistently pin
actions/checkoutto the same immutable SHA with the version comment preserved.Also applies to: 70-70
.github/actions/fetch-supported-versions/action.yaml (1)
16-20: Artifact upload pin looks good.
actions/upload-artifactis pinned to an immutable SHA and the artifact configuration remains unchanged..github/workflows/build-official-ios.yml (1)
30-30: Official iOS checkout pins are consistent.Both checkout steps use the same pinned SHA and keep the human-readable version comment.
Also applies to: 80-80
.github/workflows/build-android.yml (1)
32-32: Android checkout pins are consistent.All three checkout steps now use the same immutable
actions/checkoutrevision with the version comment retained.Also applies to: 79-79, 100-100
.github/actions/setup-node/action.yml (1)
6-12: Setup and cache actions are properly pinned.Both external actions use immutable SHAs and keep inline version comments without changing the existing Node/cache behavior.
.github/workflows/generate-changelog.yml (1)
13-13: Changelog workflow pins look good.Both third-party action references are SHA-pinned and keep clear version comments; the changelog logic is unchanged.
Also applies to: 34-34
.github/workflows/eslint.yml (1)
12-12: SHA-pinned checkout reference is properly configured.The
actions/checkoutaction is correctly pinned to a 40-character SHA with a human-readable version comment for maintainability. Repository-wide verification confirms all external action references in.github/workflows/follow this pattern..github/actions/upload-internal-android/action.yml (1)
26-39: LGTM — pins consistent with the sibling composite action.Same SHA/version mapping verification applies (see
.github/actions/upload-android/action.yml)..github/workflows/maestro-android.yml (1)
19-89: LGTM — action pins applied uniformly.No logic changes; all
uses:references now pinned with version comments. SHA-to-version verification covered in the earlier comment..github/workflows/organize_translations.yml (2)
12-42: LGTM on the SHA pins.
26-26: This concern is unfounded—thestep-security/changed-filesswitch occurred in a prior PR (#6248), not in this one.The current PR (commit 22fc494: "chore: pin github actions to sha hashes") only pins three actions:
actions/checkout,actions/setup-node, andEndBug/add-and-commit—exactly as listed in the PR summary. Thestep-security/changed-filesline was already pinned to SHA in the previous commit (3794e56: "ci: Remove tj-actions/changed-files (#6248)"), which switched fromtj-actions/changed-files@v42to the StepSecurity hardened fork. That behavioral change was addressed in PR#6248, not in this PR.> Likely an incorrect or invalid review comment..github/actions/build-android/action.yml (1)
48-154: LGTM.Pins match the same set used elsewhere (
ruby/setup-rubyv1.302.0,gradle/actions/setup-gradlev4.4.3,actions/cachev4.3.0,actions/upload-artifactv4.6.2).Note:
gradle/actions/setup-gradleis a sub-path of thegradle/actionsrepo; the SHA resolves against that repo, not a separatesetup-gradlerepo. Please include this in the SHA verification (the script in the first file already targetsgradle/actions)..github/workflows/build-official-android.yml (1)
32-97: LGTM.Three identical
actions/checkoutpins, consistent with the repo-wide pattern..github/workflows/maestro-ios.yml (1)
18-105: LGTM.All pins match those used in
maestro-android.ymland the composite actions.retry_on: timeoutbehavior preserved..github/actions/build-ios/action.yml (1)
54-170: LGTM.Xcode setup, Ruby, cache, and all five
upload-artifactsteps pinned consistently..github/actions/upload-android/action.yml (1)
26-56: All pinned SHAs match their annotated versions correctly.Verification confirmed that all third-party action SHAs across the workflow are properly mapped to their respective versions, with no mismatches found.
.github/workflows/e2e-build-ios.yml (1)
29-107: SHA pinning implemented correctly with proper version documentation.All third-party actions are correctly pinned to immutable commit SHAs with inline version comments. The SHAs for
actions/checkout@v4.3.1andactions/upload-artifact@v4.6.2have been verified as correct, and the consistent reuse of pinned SHAs across the workflow (e.g.,maxim-lobanov/setup-xcode,ruby/setup-ruby,actions/cache) confirms uniform pinning practices..github/actions/upload-ios/action.yml (1)
40-112: SHA-pinned actions correctly reference version tags and have no known security vulnerabilities.All pinned SHAs match their claimed versions: actions/download-artifact v4.3.0, actions/cache v4.3.0, maxim-lobanov/setup-xcode v1.7.0, and ruby/setup-ruby v1.302.0. The consistent use of identical SHAs for repeated actions correctly implements immutable references to mitigate supply-chain risks from mutable tags.
yasnagat
had a problem deploying
to
experimental_ios_build
GitHub Actions
Error
yasnagat
had a problem deploying
to
official_android_build
GitHub Actions
Error
yasnagat
had a problem deploying
to
experimental_android_build
GitHub Actions
Error
yasnagat
had a problem deploying
to
official_ios_build
GitHub Actions
Error
Rohit3523
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
Rohit3523
had a problem deploying
to
official_ios_build
GitHub Actions
Error
Rohit3523
had a problem deploying
to
official_android_build
GitHub Actions
Error
Rohit3523
had a problem deploying
to
experimental_android_build
GitHub Actions
Error
Rohit3523
had a problem deploying
to
experimental_ios_build
GitHub Actions
Error
OtavioStasiak
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
OtavioStasiak
had a problem deploying
to
experimental_android_build
GitHub Actions
Error
OtavioStasiak
had a problem deploying
to
official_ios_build
GitHub Actions
Error
OtavioStasiak
had a problem deploying
to
experimental_ios_build
GitHub Actions
Error
OtavioStasiak
had a problem deploying
to
official_android_build
GitHub Actions
Error
Rohit3523
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Failure
Rohit3523
had a problem deploying
to
experimental_ios_build
GitHub Actions
Failure
Rohit3523
had a problem deploying
to
official_android_build
GitHub Actions
Failure
Rohit3523
had a problem deploying
to
official_ios_build
GitHub Actions
Failure
Rohit3523
had a problem deploying
to
experimental_android_build
GitHub Actions
Failure
4 participants
Proposed changes
This PR replaces mutable tag references with immutable commit SHA pins for all third-party GitHub Actions, as part of a supply chain security hardening effort.
Each workflow file now references the exact commit SHA of the desired action version instead of a floating tag. This guarantees that the same code is always executed regardless of whether the version tag is moved or the action's repository is modified after pinning.
Issue(s)
SB-958
How to test or reproduce
Screenshots
Types of changes
Checklist
Further comments
Summary by CodeRabbit