Skip to content

fix: pin 7 unpinned action(s) #529

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dagecko wants to merge 1 commit into from
+7 −7
Closed

fix: pin 7 unpinned action(s) #529

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/e2e_android.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
node-version: 20

- name: Setup Bun
uses: oven-sh/setup-bun@v2
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
with:
bun-version: latest

Expand All @@ -57,7 +57,7 @@ jobs:
run: node -e "console.log('AVD_NAME=' + require('./Example/testHotUpdate/.detoxrc').devices.emulator.device.avdName)" >> $GITHUB_OUTPUT

- name: Detox test (android.emu.release)
uses: reactivecircus/android-emulator-runner@v2
uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2
env:
RNU_CLI_ROOT: ${{ github.workspace }}/react-native-update-cli
with:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/e2e_ios.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:
node-version: 20

- name: Setup Bun
uses: oven-sh/setup-bun@v2
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
with:
bun-version: latest

Expand All @@ -43,7 +43,7 @@ jobs:
java-version: '17'

- name: Setup Xcode
uses: maxim-lobanov/setup-xcode@v1
uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify maxim-lobanov/setup-xcode SHA corresponds to v1 tag

echo "Checking maxim-lobanov/setup-xcode v1 tag..."
gh api repos/maxim-lobanov/setup-xcode/git/ref/tags/v1 --jq '.object.sha' || gh api repos/maxim-lobanov/setup-xcode/commits/v1 --jq '.sha' 2>/dev/null

echo -e "\nDetails for pinned SHA ed7a3b1fda3918c0306d1b724322adc0b8cc0a90:"
gh api repos/maxim-lobanov/setup-xcode/commits/ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 --jq '{sha: .sha, date: .commit.committer.date, message: .commit.message}'

Repository: reactnativecn/react-native-update

Length of output: 603

🏁 Script executed:

#!/bin/bash
# Try accessing GitHub API via curl without authentication
echo "Checking v1 tag SHA..."
curl -s https://api.github.com/repos/maxim-lobanov/setup-xcode/git/refs/tags/v1 | jq '.object.sha' 2>/dev/null

echo -e "\nChecking commit details for ed7a3b1fda3918c0306d1b724322adc0b8cc0a90..."
curl -s https://api.github.com/repos/maxim-lobanov/setup-xcode/commits/ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 | jq '{sha: .sha, date: .commit.committer.date, tag: .message}' 2>/dev/null

Repository: reactnativecn/react-native-update

Length of output: 389

🌐 Web query:

maxim-lobanov setup-xcode v1 tag release SHA

💡 Result:

No specific "v1" tag release found for maxim-lobanov/setup-xcode. The repository uses maxim-lobanov/setup-xcode@v1 in usage examples, referring to the v1.x series (e.g., latest v1.6.0 at SHA 60606e2). The earliest listed release is v1.2 on 2020-10-15 at SHA dfa1339. Older v1 releases like v1.0.0 may exist but are not shown in the releases page snippets. Repository created 2020-04-26. Maxim Lobanov is the author, working at GitHub.

Citations:

🌐 Web query:

site:github.com maxim-lobanov setup-xcode ed7a3b1fda3918c0306d1b724322adc0b8cc0a90

💡 Result:

The query refers to the GitHub Actions action "setup-xcode" created by Maxim Lobanov (https://github.com/maxim-lobanov/setup-xcode). This is a popular open-source tool (370+ stars) for selecting a specific pre-installed Xcode version in GitHub Actions workflows on macOS runners. Key details: - Author: Maxim Lobanov, Senior Software Engineer at GitHub, based in Amsterdam. - Purpose: Switches between Xcode versions available on GitHub-hosted macOS runners (list in https://github.com/actions/runner-images). - Latest release: v1.6.0 (Sep 2023), last push 2024-06-25, recent activity as of Mar 2026. - Usage example: jobs: build: runs-on: macos-latest steps: - uses: maxim-lobanov/setup-xcode@v1.6.0 with: xcode-version: 'latest-stable' # or 'latest', semver like '14.3.1', or '-beta' suffix - Outputs: 'version' and 'path' of selected Xcode. - The hash "ed7a3b1fda3918c0306d1b724322adc0b8cc0a90" does not match any found commit, release, or reference in searches; it may be internal, a workflow artifact ID, or a typo. No exact match found across GitHub searches. Official docs and source: https://github.com/maxim-lobanov/setup-xcode

Citations:

🌐 Web query:

site:github.com maxim-lobanov/setup-xcode v1 tag releases

💡 Result:

The GitHub Action maxim-lobanov/setup-xcode uses the @v1 major version tag, which points to the latest minor/patch release in the v1.x.x series. There is no specific "v1" release tag; instead, releases are tagged as v1.2, v1.2.3, v1.3.0, v1.4.0, v1.4.1, v1.5.1, v1.6.0, etc. The full list of v1 releases (from oldest to newest based on available data): - v1.2 (15 Oct, commit dfa1339): Improved Xcode version parsing from app name to use build number for reliability. - v1.2.3 (21 Jul): Added "version" and "path" output variables. - v1.4.0 (07 Oct): Added ability to choose stable/unstable Xcode versions; improved version output. - v1.4.1 (04 Jan): Bumped dependencies. - v1.5.1 (19 Oct): Updated dependencies, fixed deprecated set-output warning. - v1.6.0 (23 Sep 2023): Updated Node.js to 20. The repository has 12 releases total, created starting 2020-04-26, with latest v1.6.0. Usage examples reference @v1 for the stable channel. No explicit v1.0.0 or initial v1 tag details found in search results; earliest listed is v1.2.

Citations:

Replace the pinned SHA with a valid v1.x release tag.

The pinned SHA ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 does not exist in the maxim-lobanov/setup-xcode repository and cannot be verified. Additionally, there is no "v1" tag in this repository—releases use specific version tags (v1.2, v1.3.0, v1.4.0, etc.), with the latest v1.x release being v1.6.0. Use a valid release tag like @v1.6.0 instead of the unverifiable SHA.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/e2e_ios.yml at line 46, The workflow currently pins
maxim-lobanov/setup-xcode to an unverifiable commit SHA (ed7a3b1f...) in the
uses statement; replace that SHA with a valid v1.x release tag (for example
`@v1.6.0`) so the action reference is verifiable and matches the repository's
release tags—update the uses line that contains "maxim-lobanov/setup-xcode@..."
to use a proper release tag like `@v1.6.0` (or another valid v1.* tag).

with:
xcode-version: latest-stable

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ jobs:

steps:
- uses: actions/checkout@v6
- uses: oven-sh/setup-bun@v2
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

- name: Install Dependency
run: bun install --frozen-lockfile
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
run: |
git config --global --add safe.directory "$GITHUB_WORKSPACE"
git submodule foreach --recursive 'git config --global --add safe.directory "$toplevel/$sm_path"'
- uses: oven-sh/setup-bun@v2
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
# Setup .npmrc file to publish to npm
- uses: actions/setup-node@v6
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:

steps:
- uses: actions/checkout@v6
- uses: oven-sh/setup-bun@v2
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

- name: Install Dependencies
run: bun install --frozen-lockfile
Expand Down