[adalton]

Summary

• Updated .coderabbit.yaml CI/CD security path instruction to distinguish GitHub-owned actions from third-party actions
• GitHub-owned actions (actions/*) use tag refs (e.g., @v4) for readability — no longer flagged for missing SHA pins
• Third-party actions must remain pinned by full SHA with a trailing version comment

Context

CodeRabbit repeatedly flagged actions/checkout@v4 and actions/setup-python@v5 with:

Per CI/CD security guidelines, actions must be pinned by full SHA to prevent supply-chain attacks.

This is a false positive for GitHub-owned actions, which we intentionally reference by tag. The blanket "pin by SHA" rule has been refined to match our actual convention.

Test plan

• Verify CodeRabbit no longer flags actions/checkout@v4 or actions/setup-python@v5
• Verify CodeRabbit still flags third-party actions that use tag refs instead of SHA pins

🤖 Generated with Claude Code

CI/CD Security Guidelines Update

Updated the CodeRabbit CI/CD security guidance in .coderabbit.yaml for GitHub Actions pinning conventions. The change refines the inherited security rules that apply to all workflows in .github/workflows/**/*.

Behavioral Change:

• GitHub-owned actions (actions/*): Now permitted to use tag refs (e.g., @v4) without SHA pinning. These will no longer be flagged as security violations during CodeRabbit reviews.
• Third-party actions: Remain required to pin by full commit SHA with a trailing version comment (e.g., @<sha> # v1.2.3).

This replaces the previous blanket "pin all actions by SHA" rule, eliminating false positives on widely-used GitHub-maintained actions like actions/checkout and actions/setup-python while maintaining security requirements for external dependencies.

Impact Scope:

• No structural changes to workflow files or shared resources
• Affects code review guidance for all CI/CD workflows across the repository
• Clarifies cross-workflow convention for action pinning consistency

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 47106bc2-ea25-4ae0-ad60-141d874107ab

📥 Commits

Reviewing files that changed from the base of the PR and between ab01692 and f2ca324.

📒 Files selected for processing (1)

• .coderabbit.yaml

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: Analyze (actions)
• GitHub Check: Analyze (python)

🔇 Additional comments (1)

.coderabbit.yaml (1)

467-470: LGTM!

---

Walkthrough

Updated inherited CI/CD security instructions in .coderabbit.yaml to refine the GitHub Actions pinning policy. GitHub-owned actions under actions/* may now reference version tags without full-SHA pinning; third-party actions must pin to full commit SHAs with inline version comments.

Changes

GitHub Actions pinning guidance

Layer / File(s)	Summary
Action pinning security rules .coderabbit.yaml	GitHub-owned actions/* permitted to use version tag refs (e.g., @v4); third-party actions must be pinned to full commit SHA with trailing version comment (e.g., @<sha> # v1.2.3). Replaces the earlier blanket SHA-pinning rule with this exception-aware guidance.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Suggested labels

ci-validation

Poem

🔐 A pin for each action, now wisely refined,
GitHub's own tools get a tag they can find,
Third-party code locked in SHA's strong embrace,
With version comments—security in place. ✨

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and specifically describes the main change: allowing tag refs for GitHub-owned actions in CodeRabbit configuration, which matches the PR's core objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Ai-Attribution	✅ Passed	Commit includes AI tool usage attribution with proper "Assisted-by: Claude Opus 4.6" trailer; no misuse of Co-Authored-By detected.
No-Absolute-Paths-In-Skills	✅ Passed	PR modifies .coderabbit.yaml (YAML config), not markdown files in workflow directories where the check applies (*/SKILL.md, /skills/.md, /commands/.md, */guidelines.md).
Skill-Md-Under-30-Lines	✅ Passed	No SKILL.md files were modified in this PR. The only change is to .coderabbit.yaml, so the skill-md-under-30-lines check is not applicable.
Command-Colon-Notation	✅ Passed	This PR only modifies .coderabbit.yaml (CI/CD config). No files in commands/ directories are changed, so the command-colon-notation check does not apply.
No-Orphaned-References	✅ Passed	The custom check applies only to changed markdown files in workflow directories. This PR modified only .coderabbit.yaml, a YAML config file. Check is not applicable.
No-Content-Duplication	✅ Passed	PR only modified .coderabbit.yaml; check applies only to changes in SKILL.md, guidelines.md, or controller.md files. Check not applicable.
Step-Sequencing	✅ Passed	PR only modifies .coderabbit.yaml; no skills/*.md files changed, so step-sequencing check is not applicable.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch andalton/coderabbit-sha-fix

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[amir-yogev-gh]

LGTM
I think this should go also into the other projects as well.