Fix-mode `--json` reports a `sha-as-ref` warning for a ref the same run just rewrote to a tag
维护者通常 1 天内回复
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 35/100
调研方向
Start by tracing how --json=valid,findings gathers sha-as-ref findings and how the default fix run rewrites workflow uses: lines; the issue does not name implementation files or tests. Reproduce with the supplied workflow and compare the first run's JSON findings with the rewritten line and terminal summary. Done when the first run's JSON no longer reports a warning for the SHA it replaced; linked pull request #277 is already open.
由索引模型根据 Issue 内容生成。
描述
What happened
A default fix run that rewrites uses: owner/repo@<sha> # vX.Y.Z to uses: owner/[email protected] still emits a sha-as-ref warning in its --json output, keyed by the SHA that is no longer in the workflow.
The remediation says "pin to a tag instead", which is what the run just did. A second run reports nothing. The terminal summary of the same run shows no warning.
Steps to reproduce
mkdir repro && cd repro && git init -q
mkdir -p .github/workflows
cat > .github/workflows/ci.yml <<'EOF'
name: ci
on: push
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
EOF
gh actions-lock --no-interactive --json=valid,findings 2>/dev/null
First run output (workflow now reads uses: actions/[email protected]):
{
"cli_version": "v0.4.1",
"findings": [
{
"workflow": ".github/workflows/ci.yml",
"category": "sha-as-ref",
"severity": "warning",
"confidence": "high",
"dependency": "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1",
"detail": "pinned to a bare SHA without a symbolic ref — weakens supply-chain traceability",
"remediation": "pin to a tag instead: https://github.com/actions/checkout/releases",
"doc_url": "https://github.com/github/gh-actions-lock/blob/main/docs/troubleshooting.md#sha-as-ref"
}
],
"lockfile_version": "v0.0.3",
"valid": true
}
Second run of the same command: "findings": [].
Same first run without --json prints only the pin summary, no warning:
Scanning 1 workflow
Planning pins
Pinned 1 action across 1 workflow
actions/[email protected] (3d3c42e)
└─ .github/workflows/ci.yml
With --no-narrow the workflow is left as written and the warning is accurate, so this only affects the default rewrite path.
Expected
Post-fix JSON should not carry a warning whose subject the write removed. Either drop warnings the fix resolved, or re-evaluate sha-as-ref against the rewritten uses: lines.
Environment
- gh-actions-lock v0.4.1 (
gh extension install github/gh-actions-lock --pin v0.4.1), lockfile schema v0.0.3 - gh 2.x on macOS 26 (arm64), github.com
- 主要语言
- Go
- 星标
- 317
- 派生
- 24
- 平均合并
- 1 天 8 小时
- 30 天内合并 PR
- 50
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/gh-actions-lock 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 72/100
github/gh-actions-lock#271 ·
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 38/100
github/gh-actions-lock#284 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 56/100
github/gh-actions-lock#281 · 1 个 reaction ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 25/100
github/gh-actions-lock#280 ·
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 35/100
github/gh-actions-lock#279 ·
维护者通常 1 天内回复
查看 github/gh-actions-lock 的全部 Issue
相似的 Issue
-
type:bug
难度 2/5 1-3 小时 新手友好度 72/100
nightgauge/nightgauge#3266 ·
维护者通常 1 天内回复
-
area: ai-models priority: normal
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 85/100
prime-radiant-inc/evener#6325 ·
维护者通常 1 天内回复
-
team:library-maintainers
难度 2/5 1-3 小时 新手友好度 82/100
padok-team/burrito#1208 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
bazel-contrib/rules_go#4784 · 1 条评论 ·
维护者通常 1 天内回复