Repository navigation
ci: pin the library to commit SHAs - #20
Merged
Merged
Conversation
Internal composite refs and the Lighthouse config checkout pointed at @main, so any push to main reached every consumer's next run. They now name a full commit SHA and lib-ci rejects any other form. Also pins lhci and yamllint, moves checkout/setup-node/pnpm-setup to the versions the apps already run, adds an opt-in provenance attestation to build-app, and extends CODEOWNERS to the remaining shared files and a new dependabot config. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
b307475 was the annotated tag object for v5.0.0, not a commit; use the commit fc06bc1. The lib-ci first-party check now parses the YAML instead of grepping, so it also covers lib-ci.yml and any spacing or quoting of the repository key. Attest before the release upload so an unsupported repo fails before anything is published. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
No consumer can use artifact attestations (private repos on a Team plan), so the input and step were untestable dead code. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
hieronx
changed the title
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consumers and this library's own composite refs pointed at
@main, so any push tomainreached every consumer's next run with their secrets. This PR makes the pin explicit and enforced.ea07231, currentmain), marked# lib-pin. Inside the library the SHA is an earlier commit, so the new action versions below reach the library's own composites only after a follow-up bump.lib-cigains a step that parses every workflow and action as YAML and fails any first-partyuses:or lib checkout whose ref is not a full 40-hex SHA. pinact can't validate the marker, so.pinact.yamlskips first-party refs by name. PyYAML is installed hash-pinned.checkout,setup-nodeandpnpm/action-setupmove to the versions the app repos run (v7.0.1, v7.0.0, v5.0.0; the pnpm pin is the commit, not the tag object).@lhci/cliandyamllintwere unpinned; now0.15.1and1.35.1.README.md,lighthouserc.jsonand a newdependabot.ymlexplicitly. Dependabot bumps third-party action SHAs monthly and ignores first-party refs.