Skip to content

ci: update lock threads action #1092

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erikras merged 1 commit into from
May 30, 2026
+3 −1
Merged

ci: update lock threads action #1092

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/lock.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,10 @@ jobs:
action:
runs-on: ubuntu-latest
steps:
- uses: dessant/lock-threads@v3
# dessant/lock-threads pinned to commit 89ae32b08ed1a541efecbab17912962a5e38981c
- uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c
Comment on lines +19 to +20

@coderabbitai coderabbitai Bot May 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the dessant/lock-threads commit SHA and version

# Check if the commit exists and get its details
echo "=== Verifying commit SHA ==="
gh api repos/dessant/lock-threads/commits/89ae32b08ed1a541efecbab17912962a5e38981c --jq '{sha: .sha, date: .commit.committer.date, message: .commit.message}' 2>&1

# Check what tags contain this commit
echo -e "\n=== Tags containing this commit ==="
gh api repos/dessant/lock-threads/tags --jq '.[] | select(.commit.sha == "89ae32b08ed1a541efecbab17912962a5e38981c") | {name: .name, sha: .commit.sha}'

# Get the latest release
echo -e "\n=== Latest release ==="
gh api repos/dessant/lock-threads/releases/latest --jq '{tag: .tag_name, published: .published_at, name: .name}'

# Check for security advisories
echo -e "\n=== Security advisories ==="
gh api graphql -f query='
{
  repository(owner: "dessant", name: "lock-threads") {
    vulnerabilityAlerts(first: 5) {
      nodes {
        securityVulnerability {
          advisory {
            summary
            severity
          }
        }
      }
    }
  }
}'

Repository: final-form/react-final-form

Length of output: 563

Document the pinned dessant/lock-threads version in the comment (v6.0.2)

The pinned commit 89ae32b08ed1a541efecbab17912962a5e38981c corresponds to dessant/lock-threads tag v6 / release v6.0.2 (no GitHub vulnerability alerts are reported). Update the line 19 comment to include v6.0.2 (not just the commit SHA) for easier maintenance/upgrade tracking.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lock.yml around lines 19 - 20, Update the inline comment
for the pinned GitHub Action so it includes the release tag in addition to the
commit SHA: change the comment that currently reads "dessant/lock-threads pinned
to commit 89ae32b08ed1a541efecbab17912962a5e38981c" to mention the corresponding
tag/release v6.0.2 (e.g., "dessant/lock-threads v6.0.2 pinned to commit
89ae32b08ed1a541efecbab17912962a5e38981c") so future maintainers can see the
release version while the action remains pinned to that commit.

with:
process-only: "issues, prs"
issue-inactive-days: "365"
issue-lock-reason: "resolved"
pr-inactive-days: "365"
Expand Down
Loading