Pin actions version to commit; force runner to use node 24 by ShaharNaveh · Pull Request #7685 · RustPython/RustPython

ShaharNaveh · 2026-04-25T14:05:12Z

Summary by CodeRabbit

Chores
- Updated CI workflow settings, including a top-level environment flag and several action versions pinned to specific commits for more predictable builds.
- Minor workflow formatting and comment adjustments to improve clarity and maintainability.

coderabbitai · 2026-04-25T14:05:25Z

📝 Walkthrough

Walkthrough

The CI workflow .github/workflows/ci.yaml now sets FORCE_JAVASCRIPT_ACTIONS_TO_NODE24, pins several third-party GitHub Actions to specific commit SHAs/versions, restructures the wabt action inputs to block form, and applies minor whitespace formatting around WASM-related steps.

Changes

Cohort / File(s)	Summary
CI Workflow `.github/workflows/ci.yaml`	Added top-level `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24`; pinned actions to specific commits/versions for reproducibility (`nttld/setup-ndk`, `mwilliamson/setup-wabt-action` now with block-style inputs, `peaceiris/actions-gh-pages`, `wasmerio/setup-wasmer`); adjusted comment-only label for `reviewdog/action-suggester`; minor whitespace formatting near WASM demo/test steps.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I hopped through CI at break of day,
Pinning actions so builds won't sway.
Node24 set, inputs neat and clear,
A tidy pipeline — give a cheer! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and clearly summarizes the main changes: pinning GitHub Actions to specific commit SHAs and setting FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 environment variable.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

ShaharNaveh · 2026-04-25T14:05:56Z

  CARGO_PROFILE_DEV_DEBUG: 0
  CARGO_PROFILE_RELEASE_DEBUG: 0
  CARGO_TERM_COLOR: always
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true' # TODO: Remove on 2026/06/02


This will allow #7641 to pass

coderabbitai

🧹 Nitpick comments (1)

.github/workflows/ci.yaml (1)
193-193: Optional: pin remaining third-party actions to commits for consistency with the PR intent.

A few JS-based third-party actions are still on floating refs and would be flagged by zizmor's unpinned-uses rule:

L193: nttld/setup-ndk@v1

L596: wasmerio/setup-wasmer@v3

L447: dtolnay/rust-toolchain@master (the @stable uses elsewhere are arguably idiomatic since rust-toolchain is a thin wrapper, but @master on a CI path is the riskier one)

Not blocking — feel free to defer to a follow-up if you'd rather keep this PR scoped to the Node 24 fixup.

Also applies to: 596-596, 447-447
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yaml at line 193, The workflow currently uses floating
refs for third-party actions (nttld/setup-ndk@v1, wasmerio/setup-wasmer@v3,
dtolnay/rust-toolchain@master); update each use to a pinned commit SHA (e.g.,
replace the `@v1/`@v3/@master tags with the specific commit hash from the action's
repository) so the CI is deterministic and consistent with the PR intent —
locate the three usages (nttld/setup-ndk, wasmerio/setup-wasmer,
dtolnay/rust-toolchain) and change their refs to the latest appropriate commit
SHAs.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/ci.yaml:
- Line 193: The workflow currently uses floating refs for third-party actions
(nttld/setup-ndk@v1, wasmerio/setup-wasmer@v3, dtolnay/rust-toolchain@master);
update each use to a pinned commit SHA (e.g., replace the `@v1/`@v3/@master tags
with the specific commit hash from the action's repository) so the CI is
deterministic and consistent with the PR intent — locate the three usages
(nttld/setup-ndk, wasmerio/setup-wasmer, dtolnay/rust-toolchain) and change
their refs to the latest appropriate commit SHAs.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 7073a5fb-0bc6-41bd-83a0-914958db176b

📥 Commits

Reviewing files that changed from the base of the PR and between 6ab1f80 and bae239f.

📒 Files selected for processing (1)

.github/workflows/ci.yaml

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/ci.yaml (1)
596-596: Minor: pin comment uses minor tag instead of full semver.

For consistency with the other pins in this file (# v4.0.0, # v6.0.2, # v1.24.0), consider tightening the comment label here to the exact patch tag corresponding to the SHA (e.g., # v3.1.x) so future bumps are easier to audit. Behavior unchanged.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yaml at line 596, The comment after the Wasmer setup
action uses a loose minor tag; update the inline comment on the uses:
wasmerio/setup-wasmer@24b15c95293d23f89c68bd40dac76338f773e924 line to match the
exact patch tag format used elsewhere (e.g., change "# v3.1" to the exact patch
comment like "# v3.1.x" or the specific patch "# v3.1.0" that corresponds to
that SHA) so it is consistent with the other pinned comments.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/ci.yaml:
- Line 193: The workflow pins the GitHub Action "wasmerio/setup-wasmer" to tag
v3.1 which doesn't exist; update the action reference in the workflow (the uses
entry for wasmerio/setup-wasmer) to a valid tag or commit SHA from the
wasmerio/setup-wasmer upstream repo: look up the correct release tag or copy a
full commit SHA, replace "wasmerio/setup-wasmer@v3.1" with
"wasmerio/setup-wasmer@<valid-tag-or-sha>", and re-run verification to ensure
the pin resolves successfully.

---

Nitpick comments:
In @.github/workflows/ci.yaml:
- Line 596: The comment after the Wasmer setup action uses a loose minor tag;
update the inline comment on the uses:
wasmerio/setup-wasmer@24b15c95293d23f89c68bd40dac76338f773e924 line to match the
exact patch tag format used elsewhere (e.g., change "# v3.1" to the exact patch
comment like "# v3.1.x" or the specific patch "# v3.1.0" that corresponds to
that SHA) so it is consistent with the other pinned comments.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 0f6c662e-4396-453c-8604-8d12a2d1c988

📥 Commits

Reviewing files that changed from the base of the PR and between bae239f and 5cc210f.

📒 Files selected for processing (1)

.github/workflows/ci.yaml

Pin actions version to commit; force runner to use node 24

bae239f

ShaharNaveh commented Apr 25, 2026

View reviewed changes

coderabbitai Bot reviewed Apr 25, 2026

View reviewed changes

Pin more

5cc210f

coderabbitai Bot reviewed Apr 25, 2026

View reviewed changes

Comment thread .github/workflows/ci.yaml

youknowone approved these changes Apr 26, 2026

View reviewed changes

youknowone merged commit a2afaf0 into RustPython:main Apr 26, 2026
20 checks passed

coderabbitai Bot mentioned this pull request Apr 27, 2026

Upgrade cspell to v10.0.0 #7696

Merged

coderabbitai Bot mentioned this pull request Jun 2, 2026

Remove node24 installation. It's the default now #8014

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pin actions version to commit; force runner to use node 24#7685

Pin actions version to commit; force runner to use node 24#7685
youknowone merged 2 commits into
RustPython:mainfrom
ShaharNaveh:fix-unpinned

ShaharNaveh commented Apr 25, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 25, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

ShaharNaveh Apr 25, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ShaharNaveh commented Apr 25, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

ShaharNaveh Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ShaharNaveh commented Apr 25, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 25, 2026 •

edited

Loading