Recorded on 2026年11月1日
Pin CI actions and keep them current
Coroid Expo's workflows referenced GitHub Actions by tag, and its deploy job runs with registry and cluster credentials. Coroid pinned every action to the commit of the release already in use and added grouped weekly updates.
- To the pull request
- 26 min
- To the merge
- 56 min
- Agent runs
- 4
- Criteria verified
- 6 of 6
- Model spend
- US$0.15
- Change
- 5 files, +48 −26
What was asked
Pin every uses: line to the full commit SHA of the release in use, with the version as a trailing comment, so behavior does not change. Add Dependabot with weekly, grouped updates for GitHub Actions and npm.
What happened on the way
QA checked every pin through the GitHub API: each SHA is the commit of the release tag it names. Quality Control found nothing to send back.
The outcome
Merged. Every action Expo's CI and deploy run is pinned to the release commit it already used, and Dependabot opens one grouped pull request a week per ecosystem.
The record
- Pull request #197Made by CoroidMerged as d874772ff
- 1 tasks recorded in Coroid
The repository is private, so this record names its pull requests and does not link them.