Bug: `gh actions-lock` rewrote a composite action, but did not lock it
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 30/100
调研方向
The bug is that gh actions-lock rewrites local composite actions (**/action.y(a)ml outside .github/workflows) into unpinned form without adding lockfile entries for their transitive action dependencies. Start in the Go code that walks workflow and composite action files and performs the rewrite, and check how transitive dependencies are recorded in the lockfile. Done means either skipping composite action files or locking their dependencies by reference, with a test covering a repo that has a local composite action.
由索引模型根据 Issue 内容生成。
描述
I think this is related to #183.
I observed this in https://github.com/astral-sh/uv/pull/23077.
Expected behavior
gh actions-lock should either skip rewriting **/action.ya?ml (unless it's .github/workflows/action.ya?ml) or properly lock it, i.e. include it by reference in the workflow lockfile.
Actual behavior
gh actions-lock appears to have rewritten a local composite action into its unpinned form, but without adding lockfile entries for it. The composite action's own action dependencies appear as dependencies in each calling workflow's lockfile section, but without any indication that they're transitive rather than direct.
zizmor then flags this because workflow lockfiles are per-repo, and it can't guarantee that any external user of the action gets proper hash-pins. In other words, the rewrite degrades the immutability property for external consumers of the action, even if first-party (in-repo) uses are properly locked indirectly.
- 主要语言
- Go
- 星标
- 295
- 派生
- 21
- 平均合并
- 19 小时 30 分钟
- 30 天内合并 PR
- 60
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/gh-actions-lock 的其他 Issue
-
Fix mode unpins a reusable workflow call when the same repository is also used as a step action可能已有人在做 @suzuki-shunsuke 于 1 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
github/gh-actions-lock#261 ·
维护者通常 1 天内回复
-
难度 3/5 半天 新手友好度 42/100
github/gh-actions-lock#262 ·
维护者通常 1 天内回复
-
Dependabot drops an unchanged transitive dependency when bumping a composite action可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 4/5 3-5 天 新手友好度 30/100
github/gh-actions-lock#257 · 1 条评论 ·
维护者通常 1 天内回复
-
--migrate-local-actions rewrites action files in nested worktrees and submodules可能已有人在做 @aksestok 于 2 天前认领。 未关闭
难度 3/5 1-2 天 新手友好度 20/100
github/gh-actions-lock#253 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 52/100
github/gh-actions-lock#252 ·
维护者通常 1 天内回复
查看 github/gh-actions-lock 的全部 Issue
相似的 Issue
-
component:obi contribfest go test
难度 2/5 1 小时以内 新手友好度 83/100
open-telemetry/opentelemetry-ebpf-instrumentation#4143 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
area/ambient
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
kind/cleanup
难度 2/5 1-3 小时 新手友好度 68/100
kubernetes-sigs/kueue#18324 ·
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 84/100