--verify passes when a local composite action's SHA pins are missing from the lockfile

Abierto
  • ¿Algo no está bien?
#281 0 comentarios 1 reacción 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
56/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, go
Área
cli, devtools

Línea de trabajo

Start by reading the --verify implementation and the code that scans local composite actions and compares their pins with the lockfile. Reproduce the case with the SHA-pinned composite step and tag-keyed lockfile entry described here, then run the relevant verification tests. Done means --verify reports the missing SHA-keyed entry as an error instead of declaring all workflows valid.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

gh actions-lock --verify (v0.4.1) reports every workflow valid when a local composite action pins its steps by commit SHA but the lockfile records those dependencies by tag. The runner rejects the same repository at job setup, so the frozen check in CI passes while the jobs never start.

A workflow calls a local composite action (uses: ./.github/actions/setup) whose step pins actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0. The lockfile lists that dependency as actions-rust-lang/[email protected], with commit sha1-ecabd13d1c56bd1345c230e542e9144811ad706f. Locally:

$ gh actions-lock --verify
Scanning 13 workflows
3 actions are pinned to a bare SHA without a tag ref
↳ run `gh actions-lock` to pin to tagged releases
All 13 workflows valid

The runner fails the job before any step runs (tox-dev/peryx run 42858830831):

##[error]lockfile missing pin for actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f

I expected --verify to report the missing entry, since its help text says it "fails if the lockfile is incomplete or the runner would reject a pin". Keying the entry by the SHA ('actions-rust-lang/setup-rust-toolchain@ecabd13…':) satisfies the runner, which is what tox-dev/peryx#2417 ended up doing. Related: #183, on how composite actions should lock their own dependencies.

Lenguaje dominante
Go
Estrellas
317
Forks
24
Merge medio
1 d 8 h
PR fusionados (30 d)
50

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de github/gh-actions-lock

Todos los issues de github/gh-actions-lock

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.