Repository navigation
feat(ci): use minimal check GHA workflow - #400
Merged
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughThe ChangesMinimal check CI
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
23-25: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin the new third-party action to a full commit SHA.
@v1is a movable tag, so the action implementation can change without a workflow diff. Pin the verified release commit while retainingv1in a comment for maintainability. GitHub recommends full-length SHA pinning for third-party actions. (docs.github.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 23 - 25, Update the gominimal/check action reference to use the verified full commit SHA instead of the movable `@v1` tag, and retain `@v1` in an adjacent comment for maintainability. Keep the existing channel: unstable configuration unchanged.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 23-25: Update the gominimal/check action reference to use the
verified full commit SHA instead of the movable `@v1` tag, and retain `@v1` in an
adjacent comment for maintainability. Keep the existing channel: unstable
configuration unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 48a88fe4-03c0-429d-bff6-a03540b14aae
📒 Files selected for processing (1)
.github/workflows/ci.yml
twitchyliquid64
enabled auto-merge
July 13, 2026 21:24
motdotla
pushed a commit
to motdotla/pkgs
that referenced
this pull request
Aug 27, 2026
gominimal#311) The virtio microVM guest kernel was ~50 LTS patch releases behind. We deliberately do NOT per-CVE-track the kernel -- it's CVE-dark by design, since linux:linux_kernel would flood the digest with ~1,430 mostly-inapplicable driver/subsystem CVEs a virtio guest never compiles (see gominimal#400). Riding the latest 6.12 LTS backport stream IS the kernel's security posture, so bump it. - virtio-linux 6.12.43 -> 6.12.94. Tarball staged at gs://minimal-staging-archives/linux-6.12.94.tar.xz; sha256 e998a232... verified against kernel.org's signed sha256sums.asc. - virtio-kernel-raw tracks virtio-linux's version (it only decompresses that kernel), bumped in lockstep. - virtio-linux-detonation (6.18.36, a separate mainline detonation kernel) left unchanged. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Just uses the new GHA we made rather than shelling out ourselves.
Summary by CodeRabbit