Skip to content

Pin English file transfer action to full-length commit SHA - #4100

Merged
Claudio Castillo (claudio-codebase) merged 1 commit into
devfrom
claudio-codebase/sonarqube-merge-blocker
Nov 3, 2026
Merged

Claudio Castillo (claudio-codebase) merged 1 commit into
devfrom
claudio-codebase/sonarqube-merge-blocker

Conversation

@claudio-codebase

Copy link
Copy Markdown
Contributor

Overview

Pin dmnemec/copy_file_to_another_repo_action to the full commit SHA for v1.1.1, replacing the mutable main reference to reduce supply-chain risk.

This reproduces the remaining one-line diff from #4093 on an internal repository branch so SonarQube can access the repository's SONAR_TOKEN. The original fork PR fails before analysis because that secret is unavailable.

Demo

N/A - workflow-only change.

Notes

  • Preserves Dan Fiedler as the commit author. Supersedes Pin GitHub Actions to full-length commit SHAs #4093 without changing its code diff.
  • Keeps the readable version comment and existing Dependabot seven-day cooldown. No checks are disabled and no secret-access permissions are broadened.

Testing Instructions

  • After checking out this branch, run git diff --check origin/dev...HEAD - passed.
  • Run gh api repos/dmnemec/copy_file_to_another_repo_action/commits/v1.1.1 --jq '.sha' - passed; returned c93037aa10fa8893de271f19978c980d0c1a9b37, matching the workflow pin.
  • Confirmed the local diff exactly matches Pin GitHub Actions to full-length commit SHAs #4093 and all workflow action references use full-length SHA pins.
  • npm test, npm run lint, and npm run build were not run locally because this only changes an action reference; application code is unchanged.
  • Let this PR's CI complete. Sonar Cloud analysis is expected to authenticate using the repository secret; that result is pending.

Recreates the remaining change from #4093 on an internal branch so SonarQube can run with repository secrets.
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown
Contributor

Azure Static Web Apps: Your stage site is ready! Visit it here: https://calm-wave-0c4fb390f-4100.eastus2.4.azurestaticapps.net

@lehrt

lehrt commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

Do we need this PR? We currently have an open one that does the same thing, down to the hash: https://github.com/microsoftgraph/microsoft-graph-explorer-v4/pull/4093/changes

I can approve this one and we can close the other, or we can just merge in the original? What are your thoughts?

@claudio-codebase

Copy link
Copy Markdown
Contributor Author

Do we need this PR? We currently have an open one that does the same thing, down to the hash: https://github.com/microsoftgraph/microsoft-graph-explorer-v4/pull/4093/changes

I can approve this one and we can close the other, or we can just merge in the original? What are your thoughts?

I made this PR because there was a failing step Lint, Build, Test and Deploy / Sonar Cloud analysis (i think has something to do with it coming from a fork, maybe?) on the original open PR, both should be exactly equivalent PRs - I don't have a preference. If the open PR is good to go, then I am happy to just approve it. I made this PR to see if the tests would fail or not, but it looks clean, so I think it is indeed having to do with the PR coming from a fork. I think I have overall been confused about how to handle sonarqube code analysis run failures...

@lehrt

lehrt commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

Do we need this PR? We currently have an open one that does the same thing, down to the hash: https://github.com/microsoftgraph/microsoft-graph-explorer-v4/pull/4093/changes
I can approve this one and we can close the other, or we can just merge in the original? What are your thoughts?

I made this PR because there was a failing step Lint, Build, Test and Deploy / Sonar Cloud analysis (i think has something to do with it coming from a fork, maybe?) on the original open PR, both should be exactly equivalent PRs - I don't have a preference. If the open PR is good to go, then I am happy to just approve it. I made this PR to see if the tests would fail or not, but it looks clean, so I think it is indeed having to do with the PR coming from a fork. I think I have overall been confused about how to handle sonarqube code analysis run failures...

That makes sense, lets merge this one and close the other. LGTM!

@claudio-codebase
Claudio Castillo (claudio-codebase) merged commit b57b767 into dev Nov 3, 2026
25 checks passed
@claudio-codebase
Claudio Castillo (claudio-codebase) deleted the claudio-codebase/sonarqube-merge-blocker branch November 3, 2026 19:12
@sonarqubecloud

sonarqubecloud Bot commented Nov 3, 2026

Copy link
Copy Markdown

Claudio Castillo (claudio-codebase) added a commit that referenced this pull request Nov 3, 2026
* fix: prevent createShareLink crash on invalid URL (#4008)

* fix: handle sampleUrl parsing more robustly

* suggestions for typos: https:// is incorrect or host name is incorrect. added tests and a message for first error

---------

Co-authored-by: Claudio Castillo <130110208+claudio-codebase@users.noreply.github.com>
Co-authored-by: Claudio Castillo <clcastillo@microsoft.com>

* fix: toggle sidebar button on mobile or narrow screens added

Co-authored-by: Claudio Castillo <clcastillo@microsoft.com>

* fixing bug where keyboard nav did not execute opening the link from read doc button (#4087)

Co-authored-by: Claudio Castillo <clcastillo@microsoft.com>

* fix: reverting previous commit

This reverts commit 75fc5f6.

* fix: tab stop copy button and monaco editor (response header, adaptative card) (#4086)

* tab stop and button ref

* undoing pivot item change pretty sure there is no effect at least for this bug

* forgot to pass one more buttonRef through

* no effect for the user, simplifying

* monaco editor is read only, fixing the tab navigation flow bug

* removing async statements with no awaits to satisfy sonarqube cloudgate quality failure

* added aria label changes to add to staging link and close extra PR

* added aria label to message that shows up on cached set warning in SWA preview

* dismiss button in warning needed aria label

* adding the text to GE.json

---------

Co-authored-by: Claudio Castillo <clcastillo@microsoft.com>

* fix: keyboard nav returns to feedback button after closing or submitting feedback form (#4088)

* added button refs to have the keyboard navigation return to the feedback when closing the form using esc, selecting x, or submitting the form

* timeout unnecessary pretty sure

* set keyboard focus to close button element by id instead of survey values

* expecting void to pass cloud gate test

* not sure how this got deleted but added back the focus behaviour.

* added await to async

---------

Co-authored-by: Claudio Castillo <clcastillo@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: keyboard nav read docs button

click on read docs button using keyboard navigation

* fix: persistent visual label for the key and value input boxes (#4090)

* persistent visual label for the key and value input boxes.

* capitalization difference

* made new tests that enforce the accessible version of this interface

---------

Co-authored-by: Claudio Castillo <clcastillo@microsoft.com>

* fix: remove graph toolkit tab item and content (#4097)

* remove graph toolkit tab item and content

* remove unused imports

* updated test to be consistent with changes

* removed toolkit component and files


---------

Co-authored-by: Claudio Castillo <clcastillo@microsoft.com>

* chore(dev): release 11.1.12 (#4094)

Co-authored-by: release-please-token-provider[bot] <225477224+release-please-token-provider[bot]@users.noreply.github.com>

* Pin English file transfer action to full-length commit SHA (#4100)

Recreates the remaining change from #4093 on an internal branch so SonarQube can run with repository secrets.

Co-authored-by: Dan Fiedler <danfiedler@microsoft.com>

* test: sonarqube test fixes (#4101)

* tests for uncovered code.

* sonarqube fix

---------

Co-authored-by: Claudio Castillo <clcastillo@microsoft.com>

---------

Co-authored-by: Diego Núñez <90226979+xDiegoNunezx@users.noreply.github.com>
Co-authored-by: Claudio Castillo <clcastillo@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: release-please-token-provider[bot] <225477224+release-please-token-provider[bot]@users.noreply.github.com>
Co-authored-by: Dan Fiedler <danfiedler@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants