Correct SHA for v4 ?

[svlandeg]

Hi! I'm from the fastapi team, and we're using this action in our production repos. I encountered an issue when updating to v4.

On the release page, v4.0.0 points to commit ebbaa1584979971c8614a24965b4405ff95890e0 (ebbaa15). Similarly, our dependabot wants to update to

cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0

However, this commit ID gives a 404. Can anyone explain why this is, and what the correct SHA is for v4?

[svlandeg]

Ok so maybe this was due to Github being down? Right now the commit is not a 404 anymore, though it does now warn that

This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

which I still find odd.

[YuriiMotov]

I looked into this. What is happening is that release workflow pushes the results of npm run build directly to tag.

That's why we see warning on the commit page:

This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

So, I think everything is fine

[jpalomaki]

FWIW, a StepSecurity-maintained version of this action is now available: https://github.com/step-security/wrangler-action.

See also: https://www.stepsecurity.io/blog/stepsecurity-maintained-actions-are-now-free-for-public-repos