Add lockfile to pin all gha dependencies - #855
lpmi-13 wants to merge 1 commit into
Conversation
Sorry, something went wrong.
| with: | ||
| persist-credentials: false | ||
| - uses: ./.github/actions/setup-sdk-environment | ||
| - uses: $/.github/actions/setup-sdk-environment |
There was a problem hiding this comment.
this is the documented way to refer to local actions:
https://github.com/github/gh-actions-lock#limitations
Sorry, something went wrong.
There was a problem hiding this comment.
Yeah found out about this recently when running zizmor on some of our repos. The syntax does indeed work, but clankers desperately flag this as wrong despite noting down otherwise in AGENTS.md. We don't use LLMs here much, but non-maintainers will definitely bring this up thinking it's a mistake. Alas, we might need to leave this in for now just to spare ourselves the unnecessary busywork. :(
Sorry, something went wrong.
There was a problem hiding this comment.
Sure, whatever works for you! Just to confirm, do you mean the PR needs to be updated, or we need to hold off entirely?
Sorry, something went wrong.
|
Oooh didn't know about this yet, we'll have a look! <3 |
Sorry, something went wrong.
This branch has not been deployed
Reviewers
At least 1 approving review is required to merge this pull request.
add in a github actions lockfile that asserts the actual owner of the referenced actions (just sha pinning doesn't do that and will resolve sha hashes from forks: https://www.vaines.org/posts/2026-03-24-the-comforting-lie-of-sha-pinning/).
https://github.blog/changelog/2026-10-28-github-actions-workflow-lockfiles-are-generally-available/