Repository navigation
Pin maintained actions in verification workflow - #1
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin official stable checkout v7.0.1, setup-node v7.0.0, configure-pages v6.0.0, upload-pages-artifact v5.0.0 and deploy-pages v5.0.1 releases by full SHA. JavaScript actions declare Node 24; the Pages upload composite itself pins a Node 24 upload action. Disable checkout credential persistence.
Validation: independent source review found no material issue. Hosted PR and main checks each passed 6,142 tests across 376 test files, static build and license/WASM assertions. Main Pages deployment succeeded at 3237e61; deployment is correctly guarded off in PRs. Scoped Biome does not process YAML; safe parsing, exact workflow structure and whitespace checks passed.
Live landing, both WASM resources and both plugins loaded. Model-opening interaction is unavailable in the current browser session: an isolated copy of the exact hosted artifact with visible capture-phase event diagnostics recorded no pointer/click/key events from the browser controls. No application regression is established. All nonworkflow source bytes match the preceding commit; main.js, the document-control chunk and index.html also match the prior locally verified build. Existing dependency/bundle-size warnings and the latest deploy-pages action's upstream punycode notice remain.