ci: pin full PR07 validation to reviewed source

Signed-off-by: jeremyhi <fengjiachun@gmail.com>
2026-10-12 23:12:28 +00:00 · 2026-09-22 16:56:49 +08:00
parent 0c63fb8677
commit 724a062ecf
2 changed files with 155 additions and 1 deletions
@@ -49,6 +49,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -138,6 +146,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0

      - if: matrix.mode.kafka
        name: Setup Kafka
@@ -188,6 +204,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -265,6 +289,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
          fetch-depth: 0
      - name: Run compat updater unit tests
        run: python3 -m unittest discover -s .github/scripts/tests -p 'test_*.py'
@@ -283,6 +315,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
          fetch-depth: 0
      - name: Download pre-built binaries
        uses: actions/download-artifact@v4
@@ -322,6 +362,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -453,6 +501,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - name: Download prebuilt fuzz binaries
        uses: actions/download-artifact@v4
        with:
@@ -515,6 +571,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - name: Download prebuilt fuzz binaries
        uses: actions/download-artifact@v4
        with:
@@ -576,6 +640,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -682,6 +754,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - name: Setup Kind
        uses: ./.github/actions/setup-kind
      - if: matrix.mode.minio
@@ -916,6 +996,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - name: Setup Kind
        uses: ./.github/actions/setup-kind
      - name: Setup Chaos Mesh
@@ -40,6 +40,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -58,6 +66,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -84,6 +100,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -111,6 +135,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -138,6 +170,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: ./.github/actions/setup-cyborg
      - uses: arduino/setup-protoc@v3
        with:
@@ -165,6 +205,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - name: Merge Conflict Finder
        uses: olivernybroe/action-conflict-finder@v4.0

@@ -177,6 +225,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
@@ -200,7 +256,9 @@ jobs:
        run: ../../.github/scripts/pull-test-deps-images.sh && docker compose up -d --wait

      - name: Run nextest cases
-        run: cargo nextest run --workspace -F dashboard -F pg_kvbackend -F mysql_kvbackend -F vector_index
+        run: |
+          echo 'features: dashboard,pg_kvbackend,mysql_kvbackend,vector_index'
+          cargo nextest run --workspace -F dashboard -F pg_kvbackend -F mysql_kvbackend -F vector_index
        env:
          CARGO_BUILD_RUSTFLAGS: "-C link-arg=-fuse-ld=mold"
          RUST_BACKTRACE: 1
@@ -233,6 +291,14 @@ jobs:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
+          ref: 0c63fb8677ac82dd078124251cb1c20b7544ba04
+      - name: Record tested source and runner identity
+        shell: bash
+        run: |
+          git rev-parse HEAD
+          whoami
+          id
+          test "$(id -u)" -ne 0
      - uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}