Fix mode unpins a reusable workflow call when the same repository is also used as a step action

Abierto Apto para principiantes
  • ¿Algo no está bien?
#261 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@suzuki-shunsuke ya está trabajando en esto.

Desde el 3/11/2026.

  • #263 de @suzuki-shunsuke — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
72/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, go
Área
ci-cd, cli

Línea de trabajo

Empieza en internal/workflowfile/rewrite.go, en RewriteActionRefs y subpathRewriteLookup, a los que enlaza el issue. Reproduce el problema con el workflow del issue y luego comprueba que los valores de jobs.<job_id>.uses se omiten o que las referencias bajo .github/workflows/ no se tratan como subrutas de acciones. Está listo cuando la llamada al workflow reutilizable conserva su SHA mientras la acción del step sigue reescribiéndose al tag.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

When a workflow calls a reusable workflow pinned by a commit SHA (jobs.<job_id>.uses), and a step in the same file uses an action from the same repository pinned by the same SHA, gh actions-lock rewrites the reusable workflow call to the tag too.

The lockfile doesn't lock reusable workflow calls (#179), so this replaces the SHA pin with a tag that nothing locks. Unless the tag belongs to an immutable release, it can be moved to another commit.

Version

gh-actions-lock v0.4.1

Steps to reproduce

Create .github/workflows/test.yaml in an empty Git repository:

name: test
on: pull_request
jobs:
  gomodule:
    uses: suzuki-shunsuke/download-go-module-action/.github/workflows/download.yaml@e03acd0c9d3d230019ebb7bd4a62507431fe4316 # v0.0.10
    permissions:
      contents: read
  test:
    needs: [gomodule]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: suzuki-shunsuke/download-go-module-action/restore@e03acd0c9d3d230019ebb7bd4a62507431fe4316 # v0.0.10

Run gh actions-lock.

Actual behavior

Both uses: lines are rewritten to the tag:

   gomodule:
-    uses: suzuki-shunsuke/download-go-module-action/.github/workflows/download.yaml@e03acd0c9d3d230019ebb7bd4a62507431fe4316 # v0.0.10
+    uses: suzuki-shunsuke/download-go-module-action/.github/workflows/[email protected]
 ...
     steps:
-      - uses: suzuki-shunsuke/download-go-module-action/restore@e03acd0c9d3d230019ebb7bd4a62507431fe4316 # v0.0.10
+      - uses: suzuki-shunsuke/download-go-module-action/[email protected]

Expected behavior

Only the step action is rewritten. The reusable workflow call keeps the SHA, as it does when the file has no step action from that repository.

The README says:

Reusable workflows called at jobs.<id>.uses from another repository are not locked (#179).

And the docs say:

It doesn't pin calls to reusable workflows (jobs.<job_id>.uses). To pin a reusable workflow, reference it by its full commit SHA.

So a full commit SHA is the only pin a reusable workflow call has, and gh actions-lock shouldn't rewrite it.

If the step is replaced with an action from another repository (e.g. actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1), the reusable workflow call is left as it is.

Cause

RewriteActionRefs rewrites every scalar uses: value in the file, including job-level reusable workflow calls.

The replacement map has a key for the step action, suzuki-shunsuke/download-go-module-action@e03acd0c.... subpathRewriteLookup matches owner/repo/<path>@ref against an owner/repo@ref key, so .github/workflows/download.yaml is treated as an action sub-path like restore, and the reusable workflow call gets the step action's new ref.

Skipping jobs.<job_id>.uses (or refs whose path starts with .github/workflows/) in the rewrite would fix it.

Workaround

Pin the reusable workflow call to the SHA again after running gh actions-lock. Running gh actions-lock again after that keeps the SHA.

Lenguaje dominante
Go
Estrellas
253
Forks
15
Merge medio
19 h 30 min
PR fusionados (30 d)
60

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de github/gh-actions-lock

Todos los issues de github/gh-actions-lock

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.