From 4a8b1386831759984db1cdc2e7d4399f5c4210e0 Mon Sep 17 00:00:00 2001 From: Lasse Benninga Date: Sun, 2 Aug 2026 15:29:24 +0200 Subject: [PATCH] ci: pin the grader to a stable branch name The grader pointed at fix/allow-unsafe-pr-checkout-for-autograde, a feature branch whose upstream PR (HackYourFuture/github-actions#4) was closed without merge. The pin is therefore permanent, but the name reads as disposable, and deleting it would silently break grading for weeks 11, 12 and 14 at once. stable/hyf-auto-grade points at the same commit (346f1ae8). No behaviour change; this is a rename plus a comment that tells the truth. Co-Authored-By: Claude Opus 5 --- .github/workflows/grade-assignment.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/grade-assignment.yml b/.github/workflows/grade-assignment.yml index 6083549..c2d0fad 100644 --- a/.github/workflows/grade-assignment.yml +++ b/.github/workflows/grade-assignment.yml @@ -11,9 +11,12 @@ jobs: contents: read issues: write pull-requests: write - # Temporary pin: actions/checkout v6 blocks fork checkouts under + # Load-bearing pin: actions/checkout v6 blocks fork checkouts under # pull_request_target unless allow-unsafe-pr-checkout is set. - # Revert to HackYourFuture/github-actions@main after + # Upstream fix (HackYourFuture/github-actions#4) was CLOSED WITHOUT MERGE, + # so this is permanent, not temporary. The branch name says so: do not + # delete or force-push stable/hyf-auto-grade, it grades weeks 11, 12 and 14. + # Revert to HackYourFuture/github-actions@main only if upstream lands it. # https://github.com/HackYourFuture/github-actions/pull/4 merges # (closed without merge — keep this pin while fork PRs are the path). - uses: lassebenni/github-actions-fork/.github/workflows/auto-grade.yml@fix/allow-unsafe-pr-checkout-for-autograde + uses: lassebenni/github-actions-fork/.github/workflows/auto-grade.yml@stable/hyf-auto-grade