From 1c3e434b3448e2a59aa141fae41eda023f8a3dc5 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 14:41:15 +0000 Subject: [PATCH 1/3] fix(ci): repair code-ranker reusable-workflow reference Referenced ffedoroff/code-ranker-ci, renamed to code-ranker-com/actions. GitHub Actions doesn't follow repo-rename redirects for reusable-workflow 'uses:' (REST does), so runs failed at startup: 'workflow was not found'. Point at the canonical repo and pin the immutable v1 commit SHA. Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 1a57727..37586d1 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@485febd51d1cf0f666e262de6e37e1d2e3f6d7f5 # v1 permissions: id-token: write contents: read From ab605513c746eae78499888eb6e6e795cdbdaf79 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:07:42 +0000 Subject: [PATCH 2/3] ci: bump code-ranker pin to v1 (advisory findings wording) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 37586d1..18274c2 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: code-ranker-com/actions/.github/workflows/report.yml@485febd51d1cf0f666e262de6e37e1d2e3f6d7f5 # v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c permissions: id-token: write contents: read From 690a6b28768a1f3bbc0fb889ce0ce72df7007cd7 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:24:02 +0000 Subject: [PATCH 3/3] ci: normalize code-ranker stub (clean, least-privilege) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 18274c2..208db7b 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,9 +4,12 @@ on: push: jobs: code-ranker: + # Pinned to an immutable commit SHA (supply-chain hardening). uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c permissions: id-token: write contents: read - pull-requests: write + # No pull-requests: write here — the code-ranker GitHub App posts (and + # updates in place) the report comment using its own installation + # token, not this workflow's GITHUB_TOKEN. security-events: write