ci: reference the org alias instead of a pinned commit - #85
Merged
Conversation
Pinning the bymaxone/.github references by commit removed the reason the shared repository exists: a CI fix lands once and every repository gets it. Pinned, it reaches none of them until each is bumped, and Dependabot treats each reusable workflow path as its own dependency — roughly 58 pull requests across the libraries to propagate a single change, merged in bulk, so the review they were meant to buy never happens. The gap was never the pinning. It was that v1 had become a synonym for main: merging published immediately. bymaxone/.github#28 makes v1 move only when a version tag is pushed, and v*.*.* is immutable by ruleset. Third-party actions stay pinned to a commit, which is where the supply-chain risk actually is. Their count is asserted unchanged.
There was a problem hiding this comment.
Pull request overview
This PR updates this repository’s GitHub Actions workflows to reference the organization’s reusable workflows/actions via the moving @v1 alias (instead of a pinned commit), while keeping third-party actions pinned to SHAs.
Changes:
- Switched reusable workflow references (
bymaxone/.github/.github/workflows/*) from a pinned commit SHA to@v1. - Switched the shared setup action reference (
bymaxone/.github/.github/actions/setup-node-pnpm) from a pinned commit SHA to@v1. - Removed the now-misleading “# v1” comment that previously annotated a pinned SHA.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/peer-advisory-drift.yml | Updates the reusable workflow reference to bymaxone/.github@v1. |
| .github/workflows/codeql.yml | Updates the reusable workflow reference to bymaxone/.github@v1. |
| .github/workflows/ci.yml | Updates reusable workflow and shared setup action references to @v1 across CI jobs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Returns the
bymaxone/.githubreferences to the moving@v1alias. Third-party actions stay pinned to a commit — that distinction is the whole point.Why this is a revert
Pinning these was defensible in isolation: Scorecard flags a moving tag, and GitHub's guidance recommends SHA-pinning without carving out first-party repositories.
It was still wrong here, for a reason that only shows up at organization scale:
open-pull-requests-limit: 5per repository per week.What replaces it as the control
The gap was never the pinning. It was that
v1had become a synonym formain: merging published immediately, and on 2026-08-07 eight commits to the shared repository became eight silent deploys to every consumer.bymaxone/.github#28closes that —v1now moves only when avN.Y.Ztag is pushed, that tag must be an ancestor of the default branch, andv*.*.*is immutable by ruleset. Publishing is a deliberate act; the alias is what consumers follow.Where pinning is still correct
Unchanged in this pull request, and verified as unchanged:
Those are outside the organization. That is where the supply-chain risk lives, and none of them moved.
Verification
Every touched file parses as YAML; the
uses:count is unchanged per file; the third-party pin count is asserted identical before and after; and nobymaxone/.githubreference is left on a commit.