Adopt GitHub Actions Lockfiles
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
Research direction
Start with the linked GitHub Actions Lockfiles usage documentation and Renovate pull request, then compare the proposed approach with the previous work in issue 27. Identify which repository workflows are affected; done means the applicable workflows adopt and enforce lockfiles instead of the earlier immediate-dependency hash pinning.
Written by the indexing model from the issue text.
Description
GitHub Actions Lockfiles are now in technical preview:
The GitHub community design discussion: https://github.com/orgs/community/discussions/194494
It provides true dependency tree pinning akin to package-lock.json. This is better that the previous hash-pinning which only pinned the immediate dependency, but not the nested, transient dependencies.
Renovate has added support for the lockfiles: https://github.com/renovatebot/renovate/pull/45199
From https://github.com/renovatebot/renovate/pull/45199:
gh actions-lockrewrites the workflows it manages back to plain refs
when it regenerates them, which strips out any inline digest pin
Hence, this necessarily replaces: https://github.com/loopbackio/security/issues/27
Workflow
Unlike prior art, this lockfile is used and enforced by GitHub Actions workers themselves without additional action calls.
Usage: https://github.com/github/gh-actions-lock/tree/f41c314f82c2382ef0263c8d93e6d66dce327456
- Dominant language
- TypeScript
- Stars
- 4
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from loopbackio/security
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
loopbackio/security#41 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
loopbackio/security#40 ·
-
openjsf
Difficulty 5/5 Over a week Newbie friendliness 25/100
loopbackio/security#39 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
loopbackio/security#38 ·
-
openssf
Difficulty 5/5 Over a week Newbie friendliness 25/100
loopbackio/security#37 ·
All issues in loopbackio/security
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
copse-dev/agent-pane#2953 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·