Feature request: How should composite actions lock themselves?

Aperta
  • Qualcosa non va?
#183 5 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
github-actions, go
Ambito
cli, security

Direzione di ricerca

Start by reading the current lockfile format and its documented limitation for reusable workflows, then inspect how gh actions-lock reads and merges lockfiles. The issue raises alternatives for composite actions but does not settle the format or behavior; clarify the design before implementation. Done means composite action dependencies can be pinned consistently without weakening the integrity guarantees described here.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area:composite-actions feature-request

This is somewhat related to https://github.com/github/gh-actions-lock/issues/139#issuecomment-6259216875 and has come up while I'm working on zizmor's support for lockfiles.

TL;DR: lockfiles are currently workflow-oriented, with reusable workflows as a documented limitation. But how should repos that contain composite actions pin their dependencies?

For example, in zizmor-action, we use the upload-serif action:

https://github.com/zizmorcore/zizmor-action/blob/fb1d87ba4b2f888025015a269a94ad7e991f6a7b/action.yml#L131

As is, lockfiles leave these kinds of composite actions with a bit of a gap:

  1. We can switch back to ref-pinning, and let downstream users lock as part of their resolution. However, this degrades the integrity/immutability property for users who haven't adopted lockfiles yet (or can't for whatever reason).
  2. We can keep hash-pinning our dependencies in the "old" way, but this is now out of sync with the idiom that's being established for locking workflows. In particular this means that tools like zizmor will need to have two pathways: a lockfile pathway for workflows, and a "you still have to do it the old way" for composite actions.

AFAICT this could be handled by allowing composite actions in the current lockfile format as well (keyed by repo-relative path?), and then having gh actions-lock honor the downstream lockfile when present/merge it into the upstream lockfile.

Alternatively it would be solved by the "intrinsic" idea in https://github.com/github/gh-actions-lock/issues/139#issuecomment-6259216875, since composite action definitions could grow similar dedicated syntax for pinning, etc.

Lingua principale
Go
Stelle
295
Fork
21
Merge medio
1g 3h
PR unite (30g)
64

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/gh-actions-lock

Tutte le issue di github/gh-actions-lock

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.