Skip to content

pinverify: detect non-existent tags as mismatches #7

Merged
vvoland merged 2 commits into
masterfrom
update
Apr 17, 2026
Merged

pinverify: detect non-existent tags as mismatches #7
vvoland merged 2 commits into
masterfrom
update

Conversation

@vvoland
Copy link
Copy Markdown
Owner

@vvoland vvoland commented Apr 17, 2026

No description provided.

@vvoland vvoland self-assigned this Apr 17, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 17, 2026

🔄 Action Pin Diff

⚠️ Tag / SHA Mismatch

The following pins reference a SHA that does not match the tag in the comment:

Action Tag Expected SHA Pinned SHA
actions/checkout v7.0.0 tag not found de0fac2

vvoland added a commit that referenced this pull request Apr 17, 2026
When a pin-only result (SHA unchanged) also has a tag/SHA mismatch,
it was shown in both the "⚠️ Tag / SHA Mismatch" table and the
"📌 Pinned (digest unchanged)" table. The pin-only table displayed
the incorrect tag (e.g. v7.0.0) next to the digest as if it were
valid, which is misleading.

Now results that match a mismatch entry are excluded from the
pin-only section entirely — the mismatch table already surfaces the
problem clearly.

Reproduces the issue from PR #7 where only the version comment
changed (v6.0.2 → v7.0.0) but the SHA stayed the same.

Signed-off-by: Paweł Gronowski <git@grono.dev>
vvoland added a commit that referenced this pull request Apr 17, 2026
When a pin-only result (SHA unchanged) also has a tag/SHA mismatch,
it was shown in both the "⚠️ Tag / SHA Mismatch" table and the
"📌 Pinned (digest unchanged)" table. The pin-only table displayed
the incorrect tag (e.g. v7.0.0) next to the digest as if it were
valid, which is misleading.

Now results that match a mismatch entry are excluded from the
pin-only section entirely — the mismatch table already surfaces the
problem clearly.

Reproduces the issue from PR #7 where only the version comment
changed (v6.0.2 → v7.0.0) but the SHA stayed the same.

Signed-off-by: Paweł Gronowski <git@grono.dev>
@vvoland vvoland force-pushed the update branch 4 times, most recently from e395f90 to 72c76e0 Compare April 17, 2026 11:25
vvoland added 2 commits April 17, 2026 13:26
Previously, when resolveRefSHA returned 404 or 422 (tag doesn't
exist), the error was silently swallowed and no mismatch was
reported.

Now 404/422 responses are treated as "tag not found" and produce a
mismatch with an empty expectSHA. Server errors (5xx) are still
silently skipped since they're transient.

The render handles empty expectSHA by showing "*tag not found*"
in the Expected SHA column of the mismatch table.

Signed-off-by: Paweł Gronowski <git@grono.dev>
Add `fail-on-mismatch` input (default: true) that causes the action
to exit non-zero when mismatches are detected. The comment is still
posted before failing so the PR author sees what's wrong.

Previously mismatches were only logged as warnings and the workflow
always succeeded, making it easy to miss incorrect version comments.

Signed-off-by: Paweł Gronowski <git@grono.dev>
@vvoland vvoland changed the title test!: Invalid pin pinverify: detect non-existent tags as mismatches Apr 17, 2026
@vvoland vvoland merged commit 8fd2b93 into master Apr 17, 2026
4 checks passed
@vvoland vvoland deleted the update branch April 22, 2026 16:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant