objectionary / objectionary/phino
Several CI workflows execute actions from moving master branches
Nobody has claimed this yet.
- Dominant language
- Haskell
- Stars
- 18
- Forks
- 13
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 157
Description
The phino workflows execute several third-party actions from moving master branches, including volodya-lombrozo/pdd-action, g4s8/xcop-action, ludeeus/action-shellcheck, and appleboy/telegram-action.
Those references let an unchanged commit change behavior when external default branches move, and make historical CI runs impossible to reproduce from the repository state.
Expected result:
Pin every action to an immutable release tag or commit SHA and update the references through reviewed changes.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by searching the phino workflow files for references to volodya-lombrozo/pdd-action, g4s8/xcop-action, ludeeus/action-shellcheck, and appleboy/telegram-action on moving master branches. Check the actions' releases or commits, then update each workflow reference through a reviewed change. Done means every listed action uses an immutable release tag or commit SHA and the workflows remain valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 75/100