diff --git a/.changeset/actions-lockfile.md b/.changeset/actions-lockfile.md new file mode 100644 index 000000000..1c1387962 --- /dev/null +++ b/.changeset/actions-lockfile.md @@ -0,0 +1,6 @@ +--- +--- + +ci: lock the actions every workflow runs (#1117) + +Every `uses:` was pinned to a mutable tag, so a tag moved upstream changed what CI executed and nothing recorded what a run resolved to. `gh actions-lock` now writes `.github/workflows/actions.lock` with the commit each action resolves to, keeping the readable version in the workflow, and a `lockfile` job runs `gh actions-lock --verify` so a workflow edit that is not relocked fails. `amannn/action-semantic-pull-request@v5` needed a full version before it could lock and moved to `v5.5.3`, the same major. No runtime behaviour changes; the lock stays advisory until the repository enables Workflow lockfiles. diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 000000000..6867f14ff --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,114 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/changesets.yml': + - 'actions/checkout@v3.7.0' + - 'actions/setup-node@v3.9.1' + - 'changesets/action@v1.9.0' + - 'pnpm/action-setup@v4.3.0' + '.github/workflows/checks.yml': + - 'actions/checkout@v4.4.0' + - 'actions/setup-node@v4.4.0' + - 'actions/upload-artifact@v4.6.2' + - 'coverallsapp/github-action@v2.3.6' + - 'deblockt/cucumber-report-annotations-action@v1.7' + - 'dorny/paths-filter@v3.0.4' + - 'pnpm/action-setup@v4.3.0' + - 'wagoid/commitlint-github-action@v5.5.1' + '.github/workflows/dependabot-changeset.yml': + - 'actions/checkout@v3.7.0' + - 'actions/setup-node@v4.4.0' + - 'pnpm/action-setup@v4.3.0' + '.github/workflows/deploy-website-preview.yml': + - 'actions/checkout@v3.7.0' + - 'actions/setup-node@v3.9.1' + - 'pnpm/action-setup@v4.3.0' + '.github/workflows/deploy-website.yml': + - 'actions/checkout@v3.7.0' + - 'actions/setup-node@v3.9.1' + - 'pnpm/action-setup@v4.3.0' + '.github/workflows/pr-title.yml': + - 'amannn/action-semantic-pull-request@v5.5.3' + '.github/workflows/release.yml': + - 'actions/checkout@v3.7.0' + - 'docker/build-push-action@v2.5.0' + - 'docker/login-action@v1.10.0' + - 'docker/metadata-action@v3.3.0' +dependencies: + 'actions/checkout@v3.7.0': + ref: 'v3.7.0' + commit: 'sha1-a37ce9120846195fa4ece8f58b268e6043cb2f26' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 + 'actions/setup-node@v3.9.1': + ref: 'v3.9.1' + commit: 'sha1-3235b876344d2a9aa001b8d1453c930bba69e610' + owner_id: 44036562 + repo_id: 189476904 + 'actions/setup-node@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020' + owner_id: 44036562 + repo_id: 189476904 + 'actions/upload-artifact@v4.6.2': + ref: 'v4.6.2' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'amannn/action-semantic-pull-request@v5.5.3': + ref: 'v5.5.3' + commit: 'sha1-0723387faaf9b38adef4775cd42cfd5155ed6017' + owner_id: 4038316 + repo_id: 220418983 + 'changesets/action@v1.9.0': + ref: 'v1.9.0' + commit: 'sha1-a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d' + owner_id: 51163350 + repo_id: 202093906 + 'coverallsapp/github-action@v2.3.6': + ref: 'v2.3.6' + commit: 'sha1-648a8eb78e6d50909eff900e4ec85cab4524a45b' + owner_id: 16691566 + repo_id: 200696780 + 'deblockt/cucumber-report-annotations-action@v1.7': + ref: 'v1.7' + commit: 'sha1-152244262905d9ce2b17889606535ede6c9ab79b' + owner_id: 5050163 + repo_id: 279071289 + 'docker/build-push-action@v2.5.0': + ref: 'v2.5.0' + commit: 'sha1-ad44023a93711e3deb337508980b4b5e9bcdc5dc' + owner_id: 5429470 + repo_id: 241092383 + 'docker/login-action@v1.10.0': + ref: 'v1.10.0' + commit: 'sha1-f054a8b539a109f9f41c372932f1ae047eff08c9' + owner_id: 5429470 + repo_id: 287743349 + 'docker/metadata-action@v3.3.0': + ref: 'v3.3.0' + commit: 'sha1-98669ae865ea3cffbcbaa878cf57c20bbf1c6c38' + owner_id: 5429470 + repo_id: 306769011 + 'dorny/paths-filter@v3.0.4': + ref: 'v3.0.4' + commit: 'sha1-0e4a8c6effa4802afeda77dc8d303f8176d7dfad' + owner_id: 1588572 + repo_id: 265601040 + 'pnpm/action-setup@v4.3.0': + ref: 'v4.3.0' + commit: 'sha1-b906affcce14559ad1aafd4ab0e942779e9f58b1' + owner_id: 21320719 + repo_id: 262289747 + 'wagoid/commitlint-github-action@v5.5.1': + ref: 'v5.5.1' + commit: 'sha1-9763196e10f27aef304c9b8b660d31d97fce0f99' + owner_id: 7467450 + repo_id: 212203144 diff --git a/.github/workflows/changesets.yml b/.github/workflows/changesets.yml index 4eed2da40..7581c1599 100644 --- a/.github/workflows/changesets.yml +++ b/.github/workflows/changesets.yml @@ -22,14 +22,14 @@ jobs: # RELEASE_PAT is the environment secret this job already hands to the # action for its API calls; the push needs the same credential. - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v3.7.0 with: fetch-depth: 0 token: ${{ secrets.RELEASE_PAT }} - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v4.3.0 - - uses: actions/setup-node@v3 + - uses: actions/setup-node@v3.9.1 with: node-version-file: .nvmrc cache: pnpm @@ -41,7 +41,7 @@ jobs: - run: git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - name: Create Release Pull Request or Publish - uses: changesets/action@v1 + uses: changesets/action@v1.9.0 with: version: pnpm run changeset:version publish: pnpm run changeset:publish diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml index 5ef5a96c7..ad7223772 100644 --- a/.github/workflows/checks.yml +++ b/.github/workflows/checks.yml @@ -21,11 +21,11 @@ jobs: outputs: src: ${{ steps.filter.outputs.src }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: fetch-depth: 0 - id: filter - uses: dorny/paths-filter@v3 + uses: dorny/paths-filter@v3.0.4 with: filters: | src: @@ -53,18 +53,18 @@ jobs: if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 with: fetch-depth: 0 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + - uses: pnpm/action-setup@v4.3.0 + - uses: actions/setup-node@v4.4.0 with: node-version-file: .nvmrc cache: pnpm - name: Install package dependencies run: pnpm install --frozen-lockfile - name: Run commitlint - uses: wagoid/commitlint-github-action@v5 + uses: wagoid/commitlint-github-action@v5.5.1 lint: name: Lint code @@ -73,9 +73,9 @@ jobs: if: needs.changes.outputs.src == 'true' steps: - name: Checkout - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + uses: actions/checkout@v4.4.0 + - uses: pnpm/action-setup@v4.3.0 + - uses: actions/setup-node@v4.4.0 with: node-version-file: .nvmrc cache: pnpm @@ -93,9 +93,9 @@ jobs: if: needs.changes.outputs.src == 'true' steps: - name: Checkout - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + uses: actions/checkout@v4.4.0 + - uses: pnpm/action-setup@v4.3.0 + - uses: actions/setup-node@v4.4.0 with: node-version-file: .nvmrc cache: pnpm @@ -122,9 +122,9 @@ jobs: github.head_ref != 'changeset-release/main' steps: - name: Checkout - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + uses: actions/checkout@v4.4.0 + - uses: pnpm/action-setup@v4.3.0 + - uses: actions/setup-node@v4.4.0 with: node-version-file: .nvmrc cache: pnpm @@ -137,7 +137,7 @@ jobs: - name: Run coverage for unit tests run: pnpm run cover:unit if: ${{ always() }} - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v4.6.2 name: Upload coverage report for unit tests if: ${{ always() }} with: @@ -166,9 +166,9 @@ jobs: github.head_ref != 'changeset-release/main' steps: - name: Checkout - uses: actions/checkout@v4 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + uses: actions/checkout@v4.4.0 + - uses: pnpm/action-setup@v4.3.0 + - uses: actions/setup-node@v4.4.0 with: node-version-file: .nvmrc - name: Run integration tests @@ -190,7 +190,7 @@ jobs: flag-name: Integration parallel: true github-token: ${{ secrets.GITHUB_TOKEN }} - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v4.6.2 name: Upload coverage report for integration tests if: ${{ always() }} with: @@ -221,11 +221,11 @@ jobs: if: github.event_name == 'pull_request' && github.head_ref != 'changeset-release/main' steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 with: fetch-depth: 0 - - uses: pnpm/action-setup@v4 - - uses: actions/setup-node@v4 + - uses: pnpm/action-setup@v4.3.0 + - uses: actions/setup-node@v4.4.0 with: node-version-file: .nvmrc cache: pnpm @@ -233,3 +233,21 @@ jobs: run: pnpm install --frozen-lockfile - name: Check for changeset run: pnpm exec changeset status --since origin/${{ github.base_ref }} + + lockfile: + name: Actions lockfile + runs-on: ubuntu-latest + permissions: + contents: read + env: + # Both steps call `gh`. The install clones over anonymous git, which + # works but is rate-limited; the verify resolves tags, which is a API + # call either way. One token for the job rather than one per step. + GH_TOKEN: ${{ github.token }} + steps: + - uses: actions/checkout@v4.4.0 + - name: Install gh-actions-lock + run: gh extension install github/gh-actions-lock --pin v0.4.1 + - name: Verify the lockfile against the workflows + run: gh actions-lock --verify + diff --git a/.github/workflows/dependabot-changeset.yml b/.github/workflows/dependabot-changeset.yml index 8b9bc6cd2..8396b99ad 100644 --- a/.github/workflows/dependabot-changeset.yml +++ b/.github/workflows/dependabot-changeset.yml @@ -15,7 +15,7 @@ jobs: pull-requests: read steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v3.7.0 with: ref: ${{ github.head_ref || github.ref_name }} fetch-depth: 0 @@ -29,12 +29,12 @@ jobs: echo "title=$(gh pr view --json title --jq '.title')" >> "$GITHUB_OUTPUT" - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v4.3.0 with: version: 10.33.0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v4.4.0 with: node-version: '24' cache: 'pnpm' diff --git a/.github/workflows/deploy-website-preview.yml b/.github/workflows/deploy-website-preview.yml index 5c586bd44..79d412250 100644 --- a/.github/workflows/deploy-website-preview.yml +++ b/.github/workflows/deploy-website-preview.yml @@ -91,12 +91,12 @@ jobs: - name: Checkout (for cleanup metadata) if: steps.guard.outputs.skip == 'false' - uses: actions/checkout@v3 + uses: actions/checkout@v3.7.0 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v4.3.0 if: steps.guard.outputs.skip == 'false' && github.event.action != 'closed' - - uses: actions/setup-node@v3 + - uses: actions/setup-node@v3.9.1 if: steps.guard.outputs.skip == 'false' && github.event.action != 'closed' with: node-version-file: .nvmrc diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml index a706a5496..157077b9d 100644 --- a/.github/workflows/deploy-website.yml +++ b/.github/workflows/deploy-website.yml @@ -87,11 +87,11 @@ jobs: # 1.1.1 has run on the tag ref — so the build is exactly the released # commit, even if main has advanced by the time the job starts. - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v3.7.0 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@v4.3.0 - - uses: actions/setup-node@v3 + - uses: actions/setup-node@v3.9.1 with: node-version-file: .nvmrc cache: pnpm diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 83e35389e..37c355e5d 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -13,7 +13,7 @@ jobs: name: Lint PR title runs-on: ubuntu-latest steps: - - uses: amannn/action-semantic-pull-request@v5 + - uses: amannn/action-semantic-pull-request@v5.5.3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8d43b158e..6b0a426f4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,7 +32,7 @@ jobs: packages: write steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v3.7.0 # Build the code the tag names, not the branch the dispatch was started # from. A release event already carries the tag as GITHUB_REF, so the # input only overrides it; checking out `main` while pushing the image as