From 4dede1e54858e27a9d69e9b5e3bc63de944c6c2c Mon Sep 17 00:00:00 2001 From: Noah Gift Date: Mon, 17 Aug 2026 19:59:01 +0200 Subject: [PATCH] =?UTF-8?q?ci:=20consolidate=20action=20pins=20=E2=80=94?= =?UTF-8?q?=20one=20SHA=20per=20action,=20no=20moving=20tags?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fleet asks GitHub for SIX different `actions/checkout` refs, and each one is a separate cache entry on each of 16 runners. Measured 2026-08-17: @v7 (tag) 31 uses -> v7.0.1 today @df4cb1c0… 20 -> v6.0.3 @de0fac2e… 13 -> v6.0.2 @v6, @v5 (tags) 4 @34e11487… THIS FILE 6 -> v4.3.1 16 runners x 6 refs is ~96 downloads of one action, which is why CI spent the afternoon failing on Failed to download action 'https://codeload.github.com/actions/checkout/...' 429 (Too Many Requests) ... after 3 attempts That is NOT an API rate limit — `gh api rate_limit` read core 106/5000 and graphql 0/5000 at the time. codeload is a different endpoint with no published limit, so being inside the documented budget and being 429'd are both true at once. The amplification is ours. This file is the highest-leverage single place: every repo consumes it, and it was pinning the OLDEST checkout in the fleet — v4.3.1, three majors behind. actions/checkout 34e11487 (v4.3.1) -> 3d3c42e5 (v7.0.1) actions/upload-artifact @v4 (moving tag) -> ea165f8d (v4.6.2) v7.0.1 is not a leap into the unknown: 31 uses across the fleet already run `@v7`, which resolves to exactly this commit today and passes. For those it is a no-op that removes a moving tag; for this file it is the upgrade it had been missing. No moving tags remain in this workflow. A moved tag is both a re-download and an unaudited change, so pinning is a supply-chain fix as much as a bandwidth one. Co-Authored-By: Claude Opus 5 --- .github/workflows/sovereign-ci.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/sovereign-ci.yml b/.github/workflows/sovereign-ci.yml index e05628c..ef471d6 100644 --- a/.github/workflows/sovereign-ci.yml +++ b/.github/workflows/sovereign-ci.yml @@ -187,7 +187,7 @@ jobs: # uid:gid because the runner user has no entry in the image's passwd. chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true echo "pre-checkout ownership restored under $WORK_ROOT" - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install extra packages @@ -410,7 +410,7 @@ jobs: # uid:gid because the runner user has no entry in the image's passwd. chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true echo "pre-checkout ownership restored under $WORK_ROOT" - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install extra packages @@ -617,7 +617,7 @@ jobs: # uid:gid because the runner user has no entry in the image's passwd. chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true echo "pre-checkout ownership restored under $WORK_ROOT" - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install extra packages @@ -885,7 +885,7 @@ jobs: # uid:gid because the runner user has no entry in the image's passwd. chown -R 1000:1000 "$WORK_ROOT" 2>/dev/null || true echo "pre-checkout ownership restored under $WORK_ROOT" - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install extra packages @@ -999,7 +999,7 @@ jobs: 2>/dev/null || echo "::warning::sccache stats unavailable" - name: Upload benchmark results if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: bench-${{ inputs.repo }} path: bench-results.txt @@ -1088,7 +1088,7 @@ jobs: else echo "pre-checkout ownership restored under $WORK_ROOT" fi - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install extra packages @@ -1243,7 +1243,7 @@ jobs: attestations: write contents: read steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Generate SLSA provenance