From b6382514b809d960c6fbdc85745a60c14cde04f1 Mon Sep 17 00:00:00 2001 From: Rian Stockbower Date: Tue, 15 Sep 2026 11:14:38 -0400 Subject: [PATCH] ci: pin shared action dependencies --- .github/workflows/auto-release.yml | 11 +++---- .github/workflows/release.yml | 35 +++++++++++----------- .github/workflows/test-actions.yml | 44 ++++++++++++++-------------- actions/chocolatey-push/action.yml | 2 +- actions/go-build/action.yml | 2 +- actions/go-lint/action.yml | 4 +-- actions/go-test/action.yml | 2 +- actions/identity-check/action.yml | 2 +- actions/release-preflight/action.yml | 2 +- actions/winget-submit/action.yml | 2 +- 10 files changed, 54 insertions(+), 52 deletions(-) diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index f22c4f9..d76b287 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -36,7 +36,7 @@ jobs: auto-release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: fetch-depth: 0 fetch-tags: true @@ -45,10 +45,11 @@ jobs: # validate identity AND export the normalized manifest (single source of # tag prefix + version file). validate-and-export fails here if identity # drifted on main — don't mint a tag against a bad manifest. - # NOTE: @v1 must be cut (rollout step #8) before any caller can use this - # workflow; until then these action refs won't resolve. + # Nested shared actions use the self-repository form so GitHub resolves them + # from the exact commit that supplied this reusable workflow. This requires + # an Actions runner at version 2.336.0 or newer. - id: identity - uses: open-cli-collective/.github/actions/identity-check@v1 + uses: $/actions/identity-check with: manifest-path: ${{ inputs.manifest-path }} working-directory: ${{ inputs.working-directory }} @@ -76,7 +77,7 @@ jobs: } >> "$GITHUB_OUTPUT" - id: gate - uses: open-cli-collective/.github/actions/auto-release@v1 + uses: $/actions/auto-release with: release-paths: ${{ inputs.release-paths }} tool-paths: ${{ inputs.tool-paths }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7e82d8a..675f3fe 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,8 +7,9 @@ name: Release (reusable) # comes from packaging/identity.yml via identity-check — a repo declares it once. # See cli-common distribution.md / release.md. # -# NOTE: @v1 must be cut (rollout step #8 follow-up) before any caller can use -# this workflow; until then the action refs below won't resolve. +# Callers must pin this reusable workflow to an immutable shared commit. Nested +# shared actions use the self-repository form below so they resolve from that +# same commit. This requires an Actions runner at version 2.336.0 or newer. on: workflow_call: inputs: @@ -75,14 +76,14 @@ jobs: linux-matrix: ${{ steps.meta.outputs.linux-matrix }} keychain-matrix: ${{ steps.meta.outputs.keychain-matrix }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: fetch-depth: 0 fetch-tags: true # validate identity AND export the normalized manifest in one call. - id: identity - uses: open-cli-collective/.github/actions/identity-check@v1 + uses: $/actions/identity-check with: manifest-path: ${{ inputs.manifest-path }} working-directory: ${{ inputs.working-directory }} @@ -143,17 +144,17 @@ jobs: # goreleaser-config preflight: idempotent re-runs + cask skip_upload so the # homebrew-alias step is the single atomic tap writer. goreleaser_config is # repo-root-relative (goreleaser runs from root in both repo shapes). - - uses: open-cli-collective/.github/actions/release-preflight@v1 + - uses: $/actions/release-preflight with: goreleaser-config: ${{ fromJSON(steps.meta.outputs.identity-json).goreleaser_config }} homebrew: ${{ steps.meta.outputs.has-homebrew }} tag-prefix: ${{ fromJSON(steps.meta.outputs.identity-json).tag.prefix }} - - uses: actions/setup-go@v5 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: ${{ inputs.working-directory }}/go.mod - - uses: goreleaser/goreleaser-action@v6 + - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 with: version: "~> v2" install-only: true @@ -171,7 +172,7 @@ jobs: # cert secrets (all-or-none) so an opt-out caller no-ops. MUST precede the snapshot # build so both goreleaser runs inherit the exported SIGN_IDENTITY / CODESIGN_DARWIN_SCRIPT. - name: macOS code-signing setup - uses: open-cli-collective/.github/actions/macos-codesign-setup@v1 + uses: $/actions/macos-codesign-setup with: cert-p12: ${{ secrets.macos-cert-p12 }} cert-password: ${{ secrets.macos-cert-password }} @@ -219,7 +220,7 @@ jobs: # no keychain_probe (no credstore backend to verify). - name: CGO-darwin gate if: steps.meta.outputs.has-keychain == 'true' - uses: open-cli-collective/.github/actions/darwin-gate@v1 + uses: $/actions/darwin-gate with: dist-path: dist binaries: ${{ steps.meta.outputs.keychain-matrix }} @@ -292,7 +293,7 @@ jobs: - name: Upload dist if: ${{ !inputs.dry-run }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dist path: dist @@ -312,8 +313,8 @@ jobs: matrix: include: ${{ fromJSON(needs.goreleaser.outputs.homebrew-matrix) }} steps: - - uses: actions/checkout@v4 - - uses: actions/download-artifact@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dist path: dist @@ -326,7 +327,7 @@ jobs: cask="$(find dist -name "${CANONICAL}.rb" -print -quit)" [ -n "$cask" ] || { echo "::error::canonical cask ${CANONICAL}.rb not found in dist artifact"; exit 1; } echo "cask=$cask" >> "$GITHUB_OUTPUT" - - uses: open-cli-collective/.github/actions/homebrew-alias@v1 + - uses: $/actions/homebrew-alias with: canonical-cask-file: ${{ steps.locate.outputs.cask }} canonical-token: ${{ matrix.canonical_cask }} @@ -350,7 +351,7 @@ jobs: ARM64_ASSET: ${{ matrix.arm64_asset }} CHOCO_DIR: ${{ matrix.dir }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Get checksums from release shell: pwsh env: @@ -384,7 +385,7 @@ jobs: $content = $content -replace 'CHECKSUM_ARM64_PLACEHOLDER', $env:ARM64_HASH Set-Content $script $content - name: Pack and push - uses: open-cli-collective/.github/actions/chocolatey-push@v1 + uses: $/actions/chocolatey-push with: package-id: ${{ matrix.id }} working-directory: ${{ inputs.working-directory }} @@ -407,8 +408,8 @@ jobs: FINAL_TAG: ${{ needs.goreleaser.outputs.final-tag }} WINGET_ID: ${{ matrix.id }} steps: - - uses: actions/checkout@v4 - - uses: open-cli-collective/.github/actions/winget-submit@v1 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: $/actions/winget-submit with: package-id: ${{ matrix.id }} version: ${{ needs.goreleaser.outputs.version }} diff --git a/.github/workflows/test-actions.yml b/.github/workflows/test-actions.yml index 256eb65..de5a2c7 100644 --- a/.github/workflows/test-actions.yml +++ b/.github/workflows/test-actions.yml @@ -21,7 +21,7 @@ jobs: os: [ubuntu-latest, macos-latest, windows-latest] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - uses: ./actions/go-build with: working-directory: tests/fixtures/minimal @@ -29,7 +29,7 @@ jobs: test-lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - uses: ./actions/go-test with: working-directory: tests/fixtures/minimal @@ -46,7 +46,7 @@ jobs: grammar: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: grammar matrix shell: bash run: | @@ -81,14 +81,14 @@ jobs: integration: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: conventional-commit action (valid) uses: ./actions/conventional-commit with: mode: title message: "feat(api): wire up the thing" - name: pr-title action (valid) - uses: ./actions/pr-title + uses: $/actions/pr-title with: title: "fix: handle empty config" # Negative case: proves the env→arg wiring actually rejects (a regression @@ -96,7 +96,7 @@ jobs: - name: pr-title action (invalid — must fail) id: badtitle continue-on-error: true - uses: ./actions/pr-title + uses: $/actions/pr-title with: title: "not a conventional title" - name: assert invalid title was rejected @@ -111,10 +111,10 @@ jobs: auto-release-gate: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - run: bash actions/auto-release/test_gate.sh shell: bash - - uses: actions/setup-python@v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - run: pip install "PyYAML==6.0.2" @@ -128,7 +128,7 @@ jobs: darwin-gate: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - run: bash actions/darwin-gate/test_darwin_gate.sh shell: bash @@ -137,7 +137,7 @@ jobs: macos-codesign-setup: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - run: bash actions/macos-codesign-setup/test_gate.sh shell: bash @@ -145,7 +145,7 @@ jobs: homebrew-alias: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - run: bash actions/homebrew-alias/test_alias.sh shell: bash @@ -153,8 +153,8 @@ jobs: release-preflight: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - run: pip install "PyYAML==6.0.2" "pytest>=8,<9" @@ -168,8 +168,8 @@ jobs: winget-submit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - run: pip install "PyYAML==6.0.2" "pytest>=8,<9" @@ -183,8 +183,8 @@ jobs: chocolatey-push: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - run: pip install "pytest>=8,<9" "defusedxml==0.7.1" @@ -197,8 +197,8 @@ jobs: identity-unit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - run: pip install "PyYAML==6.0.2" "pytest>=8,<9" "defusedxml==0.7.1" @@ -215,7 +215,7 @@ jobs: matrix: fixture: [slck, gro, nrq, jtk, google-cli] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - uses: ./actions/identity-check with: working-directory: tests/fixtures/identity/${{ matrix.fixture }} @@ -230,7 +230,7 @@ jobs: identity-monorepo: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - uses: ./actions/identity-check with: working-directory: tests/fixtures/identity/monorepo/tools/cfl @@ -240,7 +240,7 @@ jobs: identity-interface: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - id: export uses: ./actions/identity-check with: diff --git a/actions/chocolatey-push/action.yml b/actions/chocolatey-push/action.yml index 28c2c85..bf3848e 100644 --- a/actions/chocolatey-push/action.yml +++ b/actions/chocolatey-push/action.yml @@ -18,7 +18,7 @@ inputs: runs: using: composite steps: - - uses: actions/setup-python@v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - shell: bash diff --git a/actions/go-build/action.yml b/actions/go-build/action.yml index 21efcbc..cd3dba9 100644 --- a/actions/go-build/action.yml +++ b/actions/go-build/action.yml @@ -12,7 +12,7 @@ inputs: runs: using: composite steps: - - uses: actions/setup-go@v5 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: ${{ inputs.working-directory }}/${{ inputs.go-version-file }} - shell: bash diff --git a/actions/go-lint/action.yml b/actions/go-lint/action.yml index 05b1f9d..445c910 100644 --- a/actions/go-lint/action.yml +++ b/actions/go-lint/action.yml @@ -12,7 +12,7 @@ inputs: runs: using: composite steps: - - uses: actions/setup-go@v5 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: ${{ inputs.working-directory }}/${{ inputs.go-version-file }} # A lint config is required; golangci defaults are non-conformant (repo-layout.md §5). @@ -26,7 +26,7 @@ runs: echo "::error::no .golangci.{yml,yaml,toml} in the module root — a per-module lint config is required (repo-layout.md §5, ci.md §5); golangci defaults are non-conformant" exit 1 fi - - uses: golangci/golangci-lint-action@v7 + - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: v2.12.2 working-directory: ${{ inputs.working-directory }} diff --git a/actions/go-test/action.yml b/actions/go-test/action.yml index 0ea1aa4..186bdb9 100644 --- a/actions/go-test/action.yml +++ b/actions/go-test/action.yml @@ -16,7 +16,7 @@ inputs: runs: using: composite steps: - - uses: actions/setup-go@v5 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version-file: ${{ inputs.working-directory }}/${{ inputs.go-version-file }} - shell: bash diff --git a/actions/identity-check/action.yml b/actions/identity-check/action.yml index 12f2dd1..a0dc290 100644 --- a/actions/identity-check/action.yml +++ b/actions/identity-check/action.yml @@ -28,7 +28,7 @@ outputs: runs: using: composite steps: - - uses: actions/setup-python@v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - shell: bash diff --git a/actions/release-preflight/action.yml b/actions/release-preflight/action.yml index 7a43262..183681b 100644 --- a/actions/release-preflight/action.yml +++ b/actions/release-preflight/action.yml @@ -21,7 +21,7 @@ inputs: runs: using: composite steps: - - uses: actions/setup-python@v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - shell: bash diff --git a/actions/winget-submit/action.yml b/actions/winget-submit/action.yml index 67d5430..23a248a 100644 --- a/actions/winget-submit/action.yml +++ b/actions/winget-submit/action.yml @@ -48,7 +48,7 @@ runs: echo "::error::winget-submit requires a Windows runner because wingetcreate.exe is Windows-only" exit 1 fi - - uses: actions/setup-python@v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - shell: bash