Skip to content

chore: pin GitHub Actions to fixed SHAs#100

Closed
KooshaPari wants to merge 4 commits intoNeighTools:masterfrom
KooshaPari:chore/pin-github-actions-shas
Closed

chore: pin GitHub Actions to fixed SHAs#100
KooshaPari wants to merge 4 commits intoNeighTools:masterfrom
KooshaPari:chore/pin-github-actions-shas

Conversation

@KooshaPari
Copy link
Copy Markdown

Summary

Pin GitHub Actions to immutable SHAs for improved security and reproducibility.

Actions Pinned

Action SHA
checkout@v4 34e114876b0b11c390a56381ad16ebd13914f8d5
upload-artifact@v4 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
download-artifact@v4 ea165f8d65b6e75b540449e92b4886f43607fa02

KooshaPari and others added 3 commits March 17, 2026 23:40
Ports the multi-assembly loading feature from devopsdinosaur/UnityDoorstop
onto NeighTools/UnityDoorstop v4.5.0 baseline.

Changes:
- config.h: replace single `target_assembly` with `target_assemblies[]` array
  plus `num_assemblies` and `assembly_index` fields; add `parse_target_assembly_string()`
- config/common.c: update cleanup_config() to free array; init new fields
- windows/config.c: add parse_target_assembly_string() with semicolon-delimited
  path support and directory auto-discovery (all *.dll in a directory are added)
- bootstrap.c: loop over target_assemblies in mono_doorstop_bootstrap();
  il2cpp_doorstop_bootstrap() uses first assembly as entrypoint
- windows/entrypoint.c: check num_assemblies > 0 instead of file_exists(target_assembly)
- windows/wincrt.c: add __chkstk stub (required when linking -nodefaultlib with MSVC)
- assets/windows/doorstop_config.ini: document semicolon-delimited syntax

Usage in doorstop_config.ini:
  target_assembly=BepInEx\core\BepInEx.Preloader.dll;BepInEx\ecs_plugins

DINOForge use case: loads BepInEx preloader first, then all DLLs in
BepInEx\ecs_plugins\ (ECS plugin directory) before Unity ECS initializes.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Pin GitHub Actions to immutable SHAs for security and reproducibility:
- checkout@v4: 34e114876b0b11c390a56381ad16ebd13914f8d5
- upload-artifact@v4: 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
- download-artifact@v4: ea165f8d65b6e75b540449e92b4886f43607fa02
Copilot AI review requested due to automatic review settings May 1, 2026 08:08
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@ManlyMarco
Copy link
Copy Markdown
Collaborator

This is a lot more than what the PR name and description says. Please make clean feature branches for each PR with minimal changes.

Pin all action refs to immutable SHAs across workflow files:
- checkout@v4 → @11bd71901bbe5b1630ceea73d27597364c9af683
- checkout@v6 → @de0fac2e4500dabe0009e67214ff5f5447ce83dd
- setup-node@v4/v5, setup-python@v4/v5, setup-go@v5
- upload-artifact@v4/v7, download-artifact@v4
- cache@v3/v4, github-script@v7
- configure-pages@v5/v6, deploy-pages@v4/v5
- upload-pages-artifact@v3/v5, dependency-review-action@v4

Fixes version-tag normalization (add v4/v5 tags where missing).
Fixes double-SHA corruption artifacts from prior patching rounds.

Co-Authored-By: Claude Opus 4.7 <[email protected]>
@ManlyMarco ManlyMarco closed this May 3, 2026
@ManlyMarco ManlyMarco added the invalid This doesn't seem right label May 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

invalid This doesn't seem right

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants