Fix mode unpins a reusable workflow call when the same repository is also used as a step action

Aperta Adatta ai principianti
  • Qualcosa non va?
#261 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
72/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, go
Ambito
ci-cd, cli

Direzione di ricerca

Inizia da internal/workflowfile/rewrite.go, da RewriteActionRefs e subpathRewriteLookup, a cui rimanda la issue. Riproduci con il workflow della issue, poi verifica che i valori jobs.<job_id>.uses vengano saltati o che i ref sotto .github/workflows/ non vengano trattati come sottopercorsi di action. È completato quando la chiamata al workflow riutilizzabile mantiene il suo SHA mentre l'action dello step viene comunque riscritta al tag.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

When a workflow calls a reusable workflow pinned by a commit SHA (jobs.<job_id>.uses), and a step in the same file uses an action from the same repository pinned by the same SHA, gh actions-lock rewrites the reusable workflow call to the tag too.

The lockfile doesn't lock reusable workflow calls (#179), so this replaces the SHA pin with a tag that nothing locks. Unless the tag belongs to an immutable release, it can be moved to another commit.

Version

gh-actions-lock v0.4.1

Steps to reproduce

Create .github/workflows/test.yaml in an empty Git repository:

name: test
on: pull_request
jobs:
  gomodule:
    uses: suzuki-shunsuke/download-go-module-action/.github/workflows/download.yaml@e03acd0c9d3d230019ebb7bd4a62507431fe4316 # v0.0.10
    permissions:
      contents: read
  test:
    needs: [gomodule]
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: suzuki-shunsuke/download-go-module-action/restore@e03acd0c9d3d230019ebb7bd4a62507431fe4316 # v0.0.10

Run gh actions-lock.

Actual behavior

Both uses: lines are rewritten to the tag:

   gomodule:
-    uses: suzuki-shunsuke/download-go-module-action/.github/workflows/download.yaml@e03acd0c9d3d230019ebb7bd4a62507431fe4316 # v0.0.10
+    uses: suzuki-shunsuke/download-go-module-action/.github/workflows/[email protected]
 ...
     steps:
-      - uses: suzuki-shunsuke/download-go-module-action/restore@e03acd0c9d3d230019ebb7bd4a62507431fe4316 # v0.0.10
+      - uses: suzuki-shunsuke/download-go-module-action/[email protected]

Expected behavior

Only the step action is rewritten. The reusable workflow call keeps the SHA, as it does when the file has no step action from that repository.

The README says:

Reusable workflows called at jobs.<id>.uses from another repository are not locked (#179).

And the docs say:

It doesn't pin calls to reusable workflows (jobs.<job_id>.uses). To pin a reusable workflow, reference it by its full commit SHA.

So a full commit SHA is the only pin a reusable workflow call has, and gh actions-lock shouldn't rewrite it.

If the step is replaced with an action from another repository (e.g. actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1), the reusable workflow call is left as it is.

Cause

RewriteActionRefs rewrites every scalar uses: value in the file, including job-level reusable workflow calls.

The replacement map has a key for the step action, suzuki-shunsuke/download-go-module-action@e03acd0c.... subpathRewriteLookup matches owner/repo/<path>@ref against an owner/repo@ref key, so .github/workflows/download.yaml is treated as an action sub-path like restore, and the reusable workflow call gets the step action's new ref.

Skipping jobs.<job_id>.uses (or refs whose path starts with .github/workflows/) in the rewrite would fix it.

Workaround

Pin the reusable workflow call to the SHA again after running gh actions-lock. Running gh actions-lock again after that keeps the SHA.

Lingua principale
Go
Stelle
253
Fork
15
Merge medio
19h 30m
PR unite (30g)
60

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/gh-actions-lock

Tutte le issue di github/gh-actions-lock

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.