Feedback: A broken action.lock file causes it to be ignored
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 58/100
Research direction
Start by reproducing the behavior with the broken .github/workflows/actions.lock file in the linked actions-semver-checker commit and review workflow run 34647263399. Trace how gh-actions-lock validates or consumes malformed lockfiles, then add coverage for this case. Done means a broken lockfile is detected and the workflow fails instead of silently ignoring it.
Written by the indexing model from the issue text.
Description
I was surprised dependabot was able to suddenly update my actions without workflows failing, turned out I had somehow pushed a broken action lock file:
I'd expect this to fail when a workflow runs, but it just runs without ANY issues.
https://github.com/jessehouwing/actions-semver-checker/actions/runs/34647263399
- Dominant language
- Go
- Stars
- 253
- Forks
- 15
- Avg merge
- 19h 30m
- Merged PRs (30d)
- 60
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/gh-actions-lock
-
Fix mode unpins a reusable workflow call when the same repository is also used as a step actionPossibly taken @suzuki-shunsuke claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/gh-actions-lock#261 ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
github/gh-actions-lock#264 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 Half a day Newbie friendliness 42/100
github/gh-actions-lock#262 ·
Maintainers usually reply within 1 day
-
Dependabot drops an unchanged transitive dependency when bumping a composite actionPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 4/5 3-5 days Newbie friendliness 30/100
github/gh-actions-lock#257 · 1 comment ·
Maintainers usually reply within 1 day
-
--migrate-local-actions rewrites action files in nested worktrees and submodulesPossibly taken @aksestok claimed this 2 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 20/100
github/gh-actions-lock#253 ·
Maintainers usually reply within 1 day
All issues in github/gh-actions-lock
Similar issues
-
Routing rule or circuit breaker trip expression with an unknown CEL function hangs daprdPossibly taken @RaphaelFakhri claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
[falco-talon] Setting `podAnnotations` makes the chart fail to renderPossibly taken @RaphaelFakhri claimed this today. Openneeds-kind
Difficulty 1/5 Under an hour Newbie friendliness 88/100
falcosecurity/charts#1084 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
DataDog/terraform-provider-datadog#4479 ·
Maintainers usually reply within 2 days
-
component/tests needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
NVIDIA/nodewright#967 ·
Maintainers usually reply within 1 day