Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/workflows/test-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -97,3 +97,16 @@ jobs:
torch_version: ${{ matrix.torch_version }}
google_credentials: ${{ secrets.GCS_SERVICE_ACCOUNT_JSON }}
comfyui_flags: ${{ matrix.flags }}

notify-failure:
needs: [test-stable, test-unix-nightly]
if: ${{ failure() && github.event_name == 'push' }}
runs-on: ubuntu-latest
steps:
- name: Notify Slack of CI failure
uses: slackapi/slack-github-action@v2.1.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify tag-based action references in GitHub workflows
rg -nP '^\s*uses:\s*[^@]+@(?:v?\d+(?:\.\d+){0,2}|main|master)$' .github/workflows/*.yml

Repository: Comfy-Org/ComfyUI

Length of output: 2179


Pin slackapi/slack-github-action to a commit SHA (Line 107)

In the PR-added notify-failure job, uses: slackapi/slack-github-action@v2.1.0 is tag-based and can be retargeted; pin it to the full commit SHA for the intended release to prevent CI drift.

🧰 Tools
🪛 zizmor (1.25.2)

[error] 107-107: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test-ci.yml at line 107, The workflow currently references
the Slack action by tag in the notify-failure job (`uses:
slackapi/slack-github-action@v2.1.0`), which can be retargeted; replace the tag
with the action's full commit SHA for the specific release to pin the dependency
(update the `uses:` value in the notify-failure job to
`slackapi/slack-github-action@<full-commit-sha>` so CI won't drift).

Source: Linters/SAST tools

with:
webhook: ${{ secrets.CI_ALERTS_SLACK_WEBHOOK }}
webhook-type: incoming-webhook
payload: |
text: ":rotating_siren: ComfyUI CI failed on `${{ github.ref_name }}`\n*Commit:* <${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}|${{ github.sha }}>\n*Run:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|view logs>\n*Dashboard:* <https://ci.comfy.org/?branch=${{ github.ref_name }}|ci.comfy.org>"
Loading