Pin GitHub Actions to immutable commit SHAs - closes #1331

[fizyk]

Summary by CodeRabbit

• Chores

  • GitHub Actions workflows now use immutable commit references for checkout, artifact uploads, coverage reporting, package publishing, and artifact downloads.
  • Existing testing, coverage, publishing, and failure-reporting behaviour remains unchanged.

• Documentation

  • Added a release note documenting the policy of pinning GitHub Actions to immutable revisions for improved workflow consistency and security.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d3e5db5b-3042-45ab-ac66-4e41db37a8d6

📥 Commits

Reviewing files that changed from the base of the PR and between 93dd136 and 8e67147.

📒 Files selected for processing (7)

• .github/workflows/async-postgres.yml
• .github/workflows/dockerised-postgres.yml
• .github/workflows/oldest-postgres.yml
• .github/workflows/pypi.yml
• .github/workflows/single-postgres-windows.yml
• .github/workflows/single-postgres.yml
• newsfragments/1331.misc.rst

🚧 Files skipped from review as they are similar to previous changes (6)

• .github/workflows/dockerised-postgres.yml
• .github/workflows/async-postgres.yml
• .github/workflows/single-postgres.yml
• .github/workflows/oldest-postgres.yml
• .github/workflows/single-postgres-windows.yml
• .github/workflows/pypi.yml

---

📝 Walkthrough

Walkthrough

GitHub Actions references in PostgreSQL test and PyPI publishing workflows are changed from tags to immutable commit SHAs. Existing workflow conditions, inputs, commands, and artifact paths remain unchanged, and a news fragment records the pinning policy.

Changes

Workflow dependency pinning

Layer / File(s)	Summary
Test workflow action pins .github/workflows/*postgres*.yml	Checkout, artifact upload, and Codecov actions are pinned to specific revisions across async, Dockerised, oldest, Windows, and single PostgreSQL workflows.
Publishing action pins and release note .github/workflows/pypi.yml, newsfragments/1331.misc.rst	PyPI artifact download and publishing actions are pinned to commit SHAs, with the immutable-action policy recorded in a news fragment.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• Pin GitHub Actions to immutable commit SHAs in single-postgres-windows.yml #1331 — The workflow pinning changes and news fragment address the issue’s immutable GitHub Actions objective.

Possibly related PRs

• dbfixtures/pytest-postgresql#1339 — Both changes modify the PyPI publishing workflow and its package publishing action.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: pinning GitHub Actions in workflow files to immutable commit SHAs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Newsfragment Check	✅ Passed	newsfragments/1331.misc.rst exists and 'misc' is a valid Towncrier type in pyproject.toml.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issue-1331

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/async-postgres.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/dockerised-postgres.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/oldest-postgres.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

• 3 others

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/dockerised-postgres.yml:
- Line 52: Update the checkout steps to set persist-credentials to false in
.github/workflows/dockerised-postgres.yml (lines 52-52),
.github/workflows/oldest-postgres.yml (lines 38-38),
.github/workflows/single-postgres-windows.yml (lines 33-33), and
.github/workflows/single-postgres.yml (lines 38-38).

In `@newsfragments/1331.rst`:
- Line 1: Rename the news fragment from 1331.rst to 1331.misc.rst so it includes
Towncrier’s required type suffix, preserving its existing content unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ba1455a9-64de-4c2a-8b5a-beb156604a31

📥 Commits

Reviewing files that changed from the base of the PR and between f343005 and 93dd136.

📒 Files selected for processing (7)

• .github/workflows/async-postgres.yml
• .github/workflows/dockerised-postgres.yml
• .github/workflows/oldest-postgres.yml
• .github/workflows/pypi.yml
• .github/workflows/single-postgres-windows.yml
• .github/workflows/single-postgres.yml
• newsfragments/1331.rst