Feature request: Add support for locking actions that use YAML anchors

Open
  • Is something wrong?
#252 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
52/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
github-actions, go, yaml
Domain
cli

Research direction

The payload names no source files, so start by finding where the tool reads uses: values from workflow YAML and how it parses those documents. Reproduce with the anchored Checkout example in the issue and see whether the anchor-aliased uses: line is skipped. Done means the aliased step is detected and locked, and the expected output in the issue is confirmed with the maintainers first, since it replaces the commit SHA with a tag.

Written by the indexing model from the issue text.

Description

Current versions of actions-lock (as of v0.4.0) fail to detect and lock actions that use YAML anchors in the uses: field.

For example, the following configuration containing YAML anchors remains unhandled:

# `gh actions-lock` does not handle `uses:` that use YAML anchors
- name: Checkout
  uses: &checkout-uses actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
  with: &checkout-with
    token: ...
    persist-credentials: ...

# Run the same action again using the same version and the same parameters
- name: Checkout again
  uses: *checkout-uses
  with: *checkout-with

Proposed Feature

Implementation of YAML anchor parsing enables actions-lock to correctly detect and process these actions as lock targets.

The expected behavior involves processing such configurations as follows:

  - name: Checkout
-   uses: &checkout-uses actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+   uses: &checkout-uses actions/[email protected]
    with: &checkout-with
      token: ...
      persist-credentials: ...

  - name: Checkout again
    uses: *checkout-uses
    with: *checkout-with
Dominant language
Go
Stars
253
Forks
15
Avg merge
19h 30m
Merged PRs (30d)
60

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-actions-lock

All issues in github/gh-actions-lock

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.