Skip to content

fix(ci): checkout dispatch workflows from github.sha - #2542

Merged
twoimo merged 1 commit into
datafrom
develop
Aug 16, 2026
Merged

twoimo merged 1 commit into
datafrom
develop

Conversation

@twoimo

@twoimo twoimo commented Aug 16, 2026

Copy link
Copy Markdown
Owner

Summary

  • Close CodeQL `actions/cache-poisoning/poisonable-step` by checking out `github.sha` instead of `inputs.commit_sha`.
  • Admission still requires `github.sha == inputs.commit_sha` on protected main.

Promotion

  • `develop -> data -> main` merge commits only.

CodeQL flagged cache poisoning from privileged checkout of inputs.commit_sha. Jobs still require github.sha == inputs.commit_sha, then check out the triggering SHA only.
@vercel

vercel Bot commented Aug 16, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
tzudong Ready Ready Preview Aug 16, 2026 12:29pm

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@twoimo
twoimo merged commit 28c6a71 into data Aug 16, 2026
30 of 33 checks passed

This branch was successfully deployed

1 active deployment
Preview — 06fbbc02 Deployed Aug 16, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant