Copilot commented on code in PR #1766:
URL: https://github.com/apache/daffodil-vscode/pull/1766#discussion_r3874315014
##########
.github/workflows/CI.yml:
##########
@@ -87,7 +87,7 @@ jobs:
cache-dependency-path: yarn.lock
- name: Setup sbt
- uses: sbt/setup-sbt@508b753e53cb6095967669e0911487d2b9bc9f41 # v1
+ uses: sbt/setup-sbt@bfea3c5f48abd221b04a6df4798aa5eb8b6a2baf # v1
Review Comment:
This `sbt/setup-sbt` upgrade changes the action’s bundled/default sbt (per
the release notes, it updates to sbt 2.0.4). If this repo is still expecting
sbt 1.x, CI behavior can change or break. Consider explicitly pinning the sbt
version via the action inputs (e.g., setting an `sbt-version` in the step) to
make the build toolchain deterministic across action upgrades.
##########
.github/workflows/nightly.yml:
##########
@@ -86,7 +86,7 @@ jobs:
# some runner oses don't have sbt by default
- name: Setup sbt
- uses: sbt/setup-sbt@508b753e53cb6095967669e0911487d2b9bc9f41 # v1
+ uses: sbt/setup-sbt@bfea3c5f48abd221b04a6df4798aa5eb8b6a2baf # v1
Review Comment:
The inline comment `# v1` is a bit ambiguous now that the step is pinned to
a specific commit corresponding to v1.5.6. Consider updating the comment to
reflect the actual action release (e.g., `# v1.5.6`) to make future
auditing/debugging easier (and do the same in CI.yml for consistency).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
