fix: check.yml/suppression-gate.yml 的 harden-runner SHA 手误纠正（v1.5.1 引入的 85b0→真 v2.21.0 85d0）

[randypanding]

根因（推翻此前全部平台缓存假说）

v1.5.1（PR#32）给 check.yml 加 suppression job 时，harden-runner 的 pin 被手写错一位：05e31511f85b41b11d1cf0ef85b``**0992719546e2c（不存在）——全组织其余文件用的是 05e31511f85b41b11d1cf0ef85**d``0992719546e2c（真 v2.21.0）。一位之差导致：

• 所有引用我手写 SHA 的 workflow（check.yml、suppression-budget/gate.yml）action 解析必红（unable to find version 05e31511...85b0...——错误信息里一直带着正确答案，被 8 位前缀的目视对比掩盖）
• "1-step 残缺 manifest"\、"编译缓存缺陷"、"改名绕开" 均为误诊（v1.5.4 的改名与换 blob 因此是不必要的，无害保留）

修复

• check.yml / suppression-gate.yml 的 pin 恢复为真 v2.21.0（85d0），与全组织一致
• 误诊过程中引入的 v2.20.1（b09bb98e）探针结论作废（两个 SHA 都真实存在且可解析）

验证

• 两文件 pin 与 hygiene/test-integrity/dep-review 等完全一致（40 位全等）
• 合并发 v1.5.5 后 Use-up-Plan repin PR#52 系列应转绿（此前因该 SHA 必红）

C1：.github/ 路径，ADR-0036（修订）/0043 域。

Summary by CodeRabbit

• 维护
  • 更新运行环境安全检查组件至经过验证的版本，提升自动化流程的安全性与稳定性。
  • 保持现有工作流逻辑不变。

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 486a1b2d-77dc-454c-b0e3-134a1be7dabb

📥 Commits

Reviewing files that changed from the base of the PR and between d36123f and 265f0a6.

📒 Files selected for processing (2)

• .github/workflows/check.yml
• .github/workflows/suppression-gate.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

本次变更更新两个 GitHub Actions 工作流中的 Harden Runner 固定 commit SHA，并保留 v2.21.0 版本注释。其他工作流逻辑未变更。

Changes

Harden Runner 固定版本更新

Layer / File(s)	Summary
更新工作流中的 Harden Runner SHA .github/workflows/check.yml, .github/workflows/suppression-gate.yml	两个工作流均引用新的 Harden Runner 固定 commit SHA。版本注释仍为 v2.21.0。

Suggested labels: security, bug

Merge Risk: ⚪ Minimal · up to 265f0

This localized change corrects the pinned runner version in two workflow files; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 1 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	标题使用了有效的 Conventional Commits 前缀 fix，但长度为 92 个字符，超过 50 个字符限制。	将标题缩短至 50 个字符以内，同时保留 fix 前缀和对 harden-runner SHA 修复的核心描述。

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/harden-v2201

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Fix harden-runner pinned SHA in CI workflows (v2.21.0 85b0→85d0)

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Fix step-security/harden-runner pin typo so GitHub Actions can resolve v2.21.0.
• Align check and suppression-gate workflows with the org-wide harden-runner SHA.

Diagram

graph TD
  A["GitHub Actions"] --> B["check.yml job"] --> D["harden-runner action"] --> E["Runner egress audit"]
  A --> C["suppression-gate.yml job"] --> D
  subgraph Legend
    direction LR
    _wf["Workflow/job"] ~~~ _act["Pinned action"]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin by version tag (v2.21.0) instead of SHA

• ➕ Simpler to read and less error-prone than manual SHA entry
• ➕ Avoids breakage from single-character SHA typos
• ➖ Weaker supply-chain hardening than commit-SHA pinning (tag can move in compromised scenarios)
• ➖ Less consistent with org-wide security posture if SHA pinning is standard

2. Centralize action pins via reusable workflow

• ➕ One canonical harden-runner pin shared across workflows
• ➕ Reduces drift and copy/paste SHA typos across multiple YAML files
• ➖ Refactor overhead and additional indirection for simple repos
• ➖ May be overkill if only a few workflows exist

3. Automate pin updates via Renovate/Dependabot for GitHub Actions

• ➕ Automated PRs for action version bumps with validation
• ➕ Reduces manual edits to pinned SHAs
• ➖ Requires bot configuration/maintenance
• ➖ Still needs review discipline to ensure pins map to intended releases

Recommendation: Current approach (correct the pinned SHA to the known-good v2.21.0 commit) is the right immediate fix and preserves the security benefit of SHA pinning. If this repo frequently touches workflow pins, consider a reusable workflow or an update bot to reduce recurrence of manual SHA entry errors.

Files changed (2) +2 / -2

Bug fix (2) +2 / -2

check.ymlFix harden-runner pin to the valid v2.21.0 commit SHA +1/-1

Fix harden-runner pin to the valid v2.21.0 commit SHA

• Replaces an invalid step-security/harden-runner commit SHA (typo) with the correct v2.21.0 pinned SHA so the action can be resolved and executed.

.github/workflows/check.yml

suppression-gate.ymlFix harden-runner pin to the valid v2.21.0 commit SHA +1/-1

Fix harden-runner pin to the valid v2.21.0 commit SHA

• Updates the harden-runner action reference to the correct v2.21.0 pinned SHA, preventing workflow failure due to an unresolvable action version.

.github/workflows/suppression-gate.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can tweak Display preferences with a live preview to see your comment before it ships

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗