[only21mil]

Problem

publish-aur.yml runs actions/checkout@v6 in the job that also gets AUR_SSH_PRIVATE_KEY, the key that pushes the package every AUR user installs. windows-tests.yml runs actions/checkout@v6, voidzero-dev/setup-vp@v1 and actions/cache@v6. All four are movable tags, so whoever controls those tags decides what code runs in these jobs. The release, signing and shared CI setup paths (release-desktop.yml, desktop-macos-preview*.yml, .github/actions/setup-ci-deps) already pin the same actions to commit SHAs. These two workflows were left on tags.

Change

Each of the four uses: lines now names the commit its tag resolves to today, with a # v6 or # v1 comment, as in #26305:

Action	Tag	Commit
actions/checkout	v6	d23441a48e516b6c34aea4fa41551a30e30af803
voidzero-dev/setup-vp	v1	250f29ce396baf5e8f24498e17c0dfdebabc26eb (same pin as setup-ci-deps)
actions/cache	v6	55cc8345863c7cc4c66a329aec7e433d2d1c52a9 (same pin as setup-ci-deps and release-desktop.yml)

No version, input, permission, runner or release logic changes. The jobs run the same action code they ran in their last runs.

Scope and approval

Maintenance with no product change, so no prior approval is linked. The scope is limited to these four uses in these two workflows. #5172 was closed asking for Actions changes to be reviewed one at a time, and this PR pins the existing versions instead of upgrading them. Other workflows still use tags; pinning them, or adding a pin check or Dependabot, would each be a separate PR if you want them.

Verification

• The pins match the tags. I ran git ls-remote https://github.com/<repo>.git refs/tags/<tag> 'refs/tags/<tag>^{}' for each action. checkout v6 and cache v6 are lightweight tags on the commits above. setup-vp v1 is an annotated tag that peels to 250f29ce…. GitHub reports all three commits as verified.
• These are the commits the jobs already ran. The last successful Windows Tests run, 41185268792 on blacksmith-8vcpu-windows-2025, logged actions/checkout@v6 (SHA:d23441a4…), voidzero-dev/setup-vp@v1 (SHA:250f29ce…) and actions/cache@v6 (SHA:55cc8345…). The AUR job in release run 41193999977 logged actions/checkout@v6 (SHA:d23441a4…) and received AUR_SSH_PRIVATE_KEY in the same job.
• Inputs still exist. The action.yml at each pinned commit declares every with: input these steps pass: sparse-checkout, sparse-checkout-cone-mode, node-version-file, cache, run-install, path and key.
• Syntax. actionlint 1.7.12 on both files reports only the existing unknown-label warnings for the Blacksmith runners, which base also reports.
• Repo checks. vp run check:changed 1d626d02d95f9a2343553f6498037ee82290d304 passes: format, typecheck of 39 packages and 1 test file.

Not checked: I did not run either workflow on this branch. Windows Tests runs on a Blacksmith runner, and the AUR job only runs in pingdotgg/t3code with the AUR key. The run logs above show these jobs already ran these exact commits.

Prior PRs

• chore(security): update github actions and pin to commit sha #1339 by gameroman proposed SHA pins in five other workflows; it closed unmerged without a documented maintainer reason.
• ci: SHA-pin actions in pr-size workflow and drop dead job #4135 by kridaydave proposed a pr-size SHA pin; juliusmarminge closed it during a backlog sweep, citing review bandwidth and inviting reopening if still wanted.
• chore(ci): bump GitHub Actions to latest versions #5172 by Project516 bundled Actions major upgrades; t3dotgg asked that updates be reviewed individually. This PR preserves existing versions.
• Merged ci(release): releases no longer reinstall Vite+ in every job #26305 by t3dotgg established the same approach: pin existing action versions to the commits their current tags resolve to.

Generated with Claude Opus 5.5 and GPT-6.1 Sol in T3 Code Nightly

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: 3fd2b85
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2cacf418-ca28-4403-9b01-c6013ea9e99a

Commits

Reviewing files that changed from the base of the PR and between 3fd2b85 and cf7df94.

Files selected for processing: 2

• .github/workflows/publish-aur.yml
• .github/workflows/windows-tests.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

Walkthrough

Two GitHub Actions workflows now pin four action references to commit SHAs. The Windows test workflow’s behavior is otherwise unchanged.

Changes: Workflow action pins

Layer / File(s)	Summary
Pin workflow action references .github/workflows/publish-aur.yml, .github/workflows/windows-tests.yml	Both workflows replace version-tag action references with commit SHAs. The Windows test workflow’s behavior is otherwise unchanged.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: macroscopeapp

Merge Risk: Minimal · up to cf7df

The workflows retain their existing behavior and use the intended action versions.

Pre-merge checks: 4

Check name	Status	Explanation
Description check		The description follows the required template. It explains the problem, the focused change, scope and approval rationale, verification results, and known limitations. It provides specific action pins,…
Title check		The title clearly and concisely describes the main change: pinning GitHub Actions in the AUR publish and Windows test workflows.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description follows the required template. It explains the problem, the focused change, scope and approval rationale, verification results, and known limitations. It provides specific action pins, command results, and workflow evidence.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[macroscopeapp]

Approvability

Verdict: Approved at cf7df94

Macroscope's review found this PR approvable — Pins workflow actions to immutable commits verified to match their existing version tags. Publishing behavior, permissions, and test configuration remain unchanged while dependency reproducibility improves.

^{You can add or adjust custom eligibility rules. Learn more.}