chore: Lint pinned SHAs in CI

[ysknsid25]

🔗 Linked issue

resolves: #4513

❓ Type of change

• 📖 Documentation (updates to the documentation, readme, or JSdoc annotations)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

[vercel]

@ysknsid25 is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds a pinact workflow for pull requests that modify .github/**. The workflow checks that GitHub Actions use commit SHAs with read-only permissions and without automatic fixes or pushes.

Changes

CI SHA verification

Layer / File(s)	Summary
Pinact verification workflow .github/workflows/pinact.yml	The workflow runs on relevant pull requests, uses SHA-pinned actions, applies read-only contents permissions, enforces a five-minute timeout, and disables automatic fixes and pushes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• nitrojs/nitro#4278: Updates existing GitHub Actions pins, while this PR adds verification for pinned SHAs.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the conventional commit format and accurately describes the CI SHA-pinning linting chore.
Description check	✅ Passed	The description identifies the linked issue and correctly categorizes the changes as a CI chore.
Linked Issues check	✅ Passed	The workflow implements continuous verification that GitHub Actions remain pinned to commit SHAs, satisfying issue #4513.
Out of Scope Changes check	✅ Passed	The changes are limited to the requested pinact CI workflow and contain no unrelated modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4514

commit: 6460752

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/pinact.yml (1)

17-18: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Enable version-comment verification.

fix: "false" checks that action references are pinned, but verify remains disabled. A full-length SHA can still have a false # v... annotation or identify a commit from a fork. If version annotations are part of the policy, add verify: "true".

Proposed change

-        with: { skip_push: "true", fix: "false" }
+        with:
+          skip_push: "true"
+          fix: "false"
+          verify: "true"

The pinned pinact-action release supports this input, and its bundled pinact version recommends version-comment verification in CI. (github.com)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pinact.yml around lines 17 - 18, Update the pinact-action
configuration to add the supported verify input set to true, while preserving
the existing skip_push and fix settings.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/pinact.yml:
- Around line 3-4: Update the workflow trigger from pull_request to
pull_request_target and ensure the validator executes the trusted base-branch
workflow and configuration rather than any pull-request-modified files. Do not
load pinact configuration or workflow logic from the checked-out pull request;
keep validation behavior controlled by repository content outside the
contributor’s changes.

---

Nitpick comments:
In @.github/workflows/pinact.yml:
- Around line 17-18: Update the pinact-action configuration to add the supported
verify input set to true, while preserving the existing skip_push and fix
settings.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d2add7d5-2a60-4a5c-993b-da1c6d866bc5

📥 Commits

Reviewing files that changed from the base of the PR and between 52abde8 and 6460752.

📒 Files selected for processing (1)

• .github/workflows/pinact.yml