Feature request: How should composite actions lock themselves?
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start by reading the current lockfile format and its documented limitation for reusable workflows, then inspect how gh actions-lock reads and merges lockfiles. The issue raises alternatives for composite actions but does not settle the format or behavior; clarify the design before implementation. Done means composite action dependencies can be pinned consistently without weakening the integrity guarantees described here.
由索引模型根据 Issue 内容生成。
描述
This is somewhat related to https://github.com/github/gh-actions-lock/issues/139#issuecomment-6259216875 and has come up while I'm working on zizmor's support for lockfiles.
TL;DR: lockfiles are currently workflow-oriented, with reusable workflows as a documented limitation. But how should repos that contain composite actions pin their dependencies?
For example, in zizmor-action, we use the upload-serif action:
As is, lockfiles leave these kinds of composite actions with a bit of a gap:
- We can switch back to ref-pinning, and let downstream users lock as part of their resolution. However, this degrades the integrity/immutability property for users who haven't adopted lockfiles yet (or can't for whatever reason).
- We can keep hash-pinning our dependencies in the "old" way, but this is now out of sync with the idiom that's being established for locking workflows. In particular this means that tools like zizmor will need to have two pathways: a lockfile pathway for workflows, and a "you still have to do it the old way" for composite actions.
AFAICT this could be handled by allowing composite actions in the current lockfile format as well (keyed by repo-relative path?), and then having gh actions-lock honor the downstream lockfile when present/merge it into the upstream lockfile.
Alternatively it would be solved by the "intrinsic" idea in https://github.com/github/gh-actions-lock/issues/139#issuecomment-6259216875, since composite action definitions could grow similar dedicated syntax for pinning, etc.
- 主要语言
- Go
- 星标
- 253
- 派生
- 15
- 平均合并
- 19 小时 30 分钟
- 30 天内合并 PR
- 60
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/gh-actions-lock 的其他 Issue
-
Fix mode unpins a reusable workflow call when the same repository is also used as a step action可能已有人在做 @suzuki-shunsuke 于 1 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
github/gh-actions-lock#261 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 30/100
github/gh-actions-lock#264 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 3/5 半天 新手友好度 42/100
github/gh-actions-lock#262 ·
维护者通常 1 天内回复
-
Dependabot drops an unchanged transitive dependency when bumping a composite action可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 4/5 3-5 天 新手友好度 30/100
github/gh-actions-lock#257 · 1 条评论 ·
维护者通常 1 天内回复
-
--migrate-local-actions rewrites action files in nested worktrees and submodules可能已有人在做 @aksestok 于 2 天前认领。 未关闭
难度 3/5 1-2 天 新手友好度 20/100
github/gh-actions-lock#253 ·
维护者通常 1 天内回复
查看 github/gh-actions-lock 的全部 Issue
相似的 Issue
-
mqtt_paho: transformer.DeleteExtension and DeleteAttribute make WritePubMessage fail可能已有人在做 @RaphaelFakhri 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 86/100
cloudevents/sdk-go#1349 ·
-
getChaosHub always returns totalFaults "0"可能已有人在做 @Aryanbhargava18 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
litmuschaos/litmus#5710 ·
维护者通常 3 天内回复
-
vtselect: data race in Tempo search tags APIs for invalid TraceQL queries可能已有人在做 @Shubham19032004 今天认领。 未关闭bug
难度 2/5 1-3 小时 新手友好度 78/100
VictoriaMetrics/VictoriaTraces#304 ·
维护者通常 1 天内回复
-
kn secret create --tls-cert creates the certificate under the wrong key可能已有人在做 @RaphaelFakhri 今天认领。 未关闭
难度 1/5 1 小时以内 新手友好度 91/100
维护者通常 1 天内回复
-
Routing rule or circuit breaker trip expression with an unknown CEL function hangs daprd可能已有人在做 @RaphaelFakhri 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复