Repository navigation
ci: pin the remaining GitHub Actions by commit SHA, and refuse a tag - #2474
Merged
Merged
Conversation
Twenty `uses:` references were still pinned by tag only: docker-publish.yml (ten), ci.yml (`actions/cache@v6` x3), gate-contracts.yml (setup-python x2, setup-node), release.yml, release-mcpb.yml (x2), release-memory.yml, and `actions/checkout@v7`. A tag is a pointer its owner can move under a job that holds the repository's secrets; every other reference in the tree already names a 40-hex commit with the version in a comment. Each reference now names the commit its tag resolved to when this change was written, checked with git ls-remote (every tag involved is lightweight, so there is no peeled commit to take). No version is bumped: where a moving major tag had advanced past the pin the rest of the tree carries, the pin follows the tag, and the comment names the exact release found at that commit. Dependabot's github-actions ecosystem keeps moving SHA and comment together. scripts/tests/test_workflow_actions_pinned.py is the guard that was missing. It is discovered by the Gate Contracts job, so a tag, a branch or a short SHA in a workflow fails CI Success, and its refusals are exercised on synthetic lines as well as on the real tree.
Up to standards ✅🟢 Issues
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Twenty
uses:references were still pinned by tag only, although every other reference in the tree names a 40-hex commit with the version in a comment. A tag is a pointer its owner can move under a job that holds the repository's secrets (the Docker publish and release workflows push images and packages). Each reference now names the commit its tag resolved to, with the matchingvX.Y.Zin the comment.No version is bumped. Where a moving major tag had advanced past the pin the rest of the tree carries (
upload-artifact@v7is v7.0.2 today, ci.yml pins v7.0.1;download-artifact@v8is v8.0.2, ci.yml pins v8.0.1), the pin follows the tag, so behaviour is what the job ran until now. Dependabot'sgithub-actionsecosystem (already in.github/dependabot.yml) moves SHA and comment together from here.A guard was missing:
scripts/tests/test_workflow_actions_pinned.pyfails on anyuses:that is not a local reference, a lower-case 40-hex commit, or adocker://image pinned by@sha256:digest. It is picked up byunittest discoverin the Gate Contracts job, whichci.ymlcalls, so it reachesCI Successwith no new wiring. It does not require the trailing version comment (that is what Dependabot reads, not what makes the pin safe);awalsh128/cache-apt-pkgs-actionin propagation-guard.yml andcontributor-assistant/github-actionin cla.yml are SHA-pinned without one, left as they are.References changed (every changed line touches only the
uses:ref and its comment)git ls-remote https://github.com/<repo>.git refs/tags/<tag> 'refs/tags/<tag>^{}': all ten tags are lightweight (no peeled^{}line), andv<major>andvX.Y.Zlist the same commit.actions/checkout@v73d3c42e5aac5ba805825da76410c181273ba90b1actions/cache@v655cc8345863c7cc4c66a329aec7e433d2d1c52a9actions/setup-python@v76d4fd22b20465ccc0f7354476588e8df7c9ca0e0actions/setup-node@v7.1.0949feb2413d6458794dcd2491c4babbbce0c15c1actions/upload-artifact@v7cf430e030ddbb5b0abf93d22962f4752f3646cd9actions/download-artifact@v89000827ccba6bdab643e8b6fd33ac0654aef8333docker/setup-buildx-action@v4f87e5991a6d7451dcb8d9637bfbc97413f497069docker/login-action@v481c6f93d4bc991e510b342a00b419b3bb4efc5c6docker/metadata-action@v6dc802804100637a589fabce1cb79ff13a1411302docker/build-push-action@v7c3c9e263c25d99ce0380d002d59b67737d91b0dcType of Change
How Has This Been Tested?
docker://by tag, a SHA hidden in a trailing comment) and its acceptances (local actions and workflows, quoted SHA, digest-pinned image, commented-out lines).python -m unittest discover -s scripts/tests -p "test_*.py" -t .: 1281 tests OK (14 skipped); every workflow parses withyaml.safe_load.check-promise-contract.pyexits 1 here and on a cleanorigin/developalike.Pull-request coverage, stated plainly:
docker-publish.yml,release.yml,release-mcpb.ymlandrelease-memory.ymldo not run on pull requests, so their pins are verified statically only (the table above and thels-remoteevidence). Theci.ymlandgate-contracts.ymlpins run in this PR's checks.Test Configuration:
Checklist