Conversation
The workflow used bun-version: latest, leaving the build runtime unpinned while every action around it is pinned to a commit SHA. Pin to 1.3.14 to match local development and keep builds reproducible.
zizmor flagged excessive-permissions: the workflow declared per-job permissions but had no workflow-level default, so it inherited the runner default. Both jobs already declare what they need, so denying by default at the top level costs nothing.
Replace the hand-rolled "pip install zizmor && zizmor ." step with zizmorcore/zizmor-action pinned to v0.6.2 (bundles zizmor 1.29.0). The pip install was unpinned, making the security scanner the one unpinned link in an otherwise SHA-pinned chain. Results also went nowhere with only contents: read, so add security-events: write to upload SARIF to code scanning.
v3.0.0 publishes ahoy-bin-linux-armv7 and ahoy-bin-linux-armv6 alongside amd64 and arm64, but the install one-liner only detected the latter two. Add cases for both, and match armv8* to arm64. Also replace the "*) echo amd64" catch-all with an explicit error. Previously an unrecognised machine silently downloaded the amd64 binary, which then failed to execute; it now aborts before wget with a clear message rather than installing an unusable binary. Patterns are parenthesised so the case survives zsh command substitution; verified the one-liner parses under sh, bash, zsh and dash.
homebrew-core moved the ahoy formula to 3.0.0, so brew install ahoy no longer yields v2. The Linux one-liner is affected too, since it downloads from /releases/latest/. Add an aside to the installation section covering both: v3 is intended to be backwards compatible with existing v2 .ahoy.yml files, and anyone who still needs v2 should take v2.5.0 from the GitHub releases page. There is no ahoy@2 formula, so that is the only route to v2 on macOS as well as Linux. Note the v2 assets are named differently to v3 (ahoy-bin-linux-arm rather than the armv6/armv7 split), so the pinned-tag URL is given rather than reusing the command above.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. WalkthroughThe workflows now set explicit permissions and pinned tool versions. The repository ignores ChangesRepository maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The PR updates install/version guidance and GitHub Actions configuration; the documented ARM mappings and v3 release note remain valid. No actionable merge-blocking risk remains beyond normal checks. Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
2 participants
Summary by CodeRabbit
Documentation
Bug Fixes