ci(security-scan): skip gh-aw generated *.lock.yml in actionlint#22
Conversation
gh-aw lock files are machine-generated and validated by `gh aw lint`; actionlint flags false-positives in them (concurrency.queue key its version doesn't know + info-level shellcheck in embedded scripts), failing the gate on every repo running agentic workflows. Lint hand-written workflows fully, skip the generated locks. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
More reviews will be available in 31 minutes and 18 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Agentic-workflow rollout across the org made every PR red on
scan / actionlint: actionlint flags gh-aw's generated*.lock.yml(aconcurrency.queuekey its pinned version doesn't recognize + info-level SC2086/SC2015 in embedded run scripts). Those files are machine-generated and validated bygh aw lint/gh aw compile.This lints hand-written workflows fully and skips only the generated locks — fixes the gate across all repos that call this reusable scan (npm, crates, research, … the full gh-aw fleet).