From e6b98c2af48650761030a36b4f8b49cbb45904f0 Mon Sep 17 00:00:00 2001 From: Valentin Maerten Date: Sun, 25 Oct 2026 15:28:49 +0100 Subject: [PATCH] chore(ci): adopt GitHub Actions dependency lockfile --- .github/renovate.json | 11 +- .github/workflows/actions.lock | 104 ++++++++++++++++++ .github/workflows/ci.yml | 59 ++++++---- .github/workflows/issue-awaiting-response.yml | 2 +- .github/workflows/issue-closed.yml | 2 +- .github/workflows/issue-experiment.yml | 14 +-- .github/workflows/issue-needs-triage.yml | 2 +- .github/workflows/release-nightly.yml | 6 +- .github/workflows/release.yml | 12 +- website/src/next/docs/contributing.md | 17 +++ 10 files changed, 189 insertions(+), 40 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/renovate.json b/.github/renovate.json index a8cfee22a4..06f9c0f4e0 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -6,13 +6,22 @@ "schedule:weekly", ":semanticCommitTypeAll(chore)" ], - "addLabels":["area: dependencies"], + "addLabels": ["area: dependencies"], "osvVulnerabilityAlerts": true, "postUpdateOptions": ["gomodTidy"], "constraints": { "go": "1.26.4" }, "customManagers": [ + { + "customType": "regex", + "managerFilePatterns": ["/^\\.github/workflows/.*\\.ya?ml$/"], + "matchStrings": [ + "gh extension install github/gh-actions-lock --pin (?v[\\d.]+)" + ], + "datasourceTemplate": "github-releases", + "depNameTemplate": "github/gh-actions-lock" + }, { "customType": "regex", "managerFilePatterns": ["/^\\.github/workflows/.*\\.ya?ml$/"], diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000000..9779c73abe --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,104 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/ci.yml': + - 'actions/checkout@v7.0.1' + - 'actions/github-script@v9.0.0' + - 'actions/setup-go@v7.0.0' + - 'actions/setup-node@v7.1.0' + - 'actions/setup-python@v7.0.0' + - 'go-task/setup-task@v2.2.0' + - 'golang/govulncheck-action@v1.1.0' + - 'golangci/golangci-lint-action@v9.3.0' + - 'hustcer/setup-nu@v3.28' + - 'pnpm/action-setup@v6.0.10' + '.github/workflows/issue-awaiting-response.yml': + - 'actions/github-script@v9.0.0' + '.github/workflows/issue-closed.yml': + - 'actions/github-script@v9.0.0' + '.github/workflows/issue-experiment.yml': + - 'actions/github-script@v9.0.0' + '.github/workflows/issue-needs-triage.yml': + - 'actions/github-script@v9.0.0' + '.github/workflows/release-nightly.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-go@v7.0.0' + - 'goreleaser/goreleaser-action@v7.2.3' + '.github/workflows/release.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-go@v7.0.0' + - 'actions/setup-node@v7.1.0' + - 'go-task/setup-task@v2.2.0' + - 'goreleaser/goreleaser-action@v7.2.3' + - 'pnpm/action-setup@v6.0.10' +dependencies: + 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd': + ref: 'v6.0.2' + commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/github-script@v9.0.0': + ref: 'v9.0.0' + commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3' + owner_id: 44036562 + repo_id: 205262760 + 'actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5': + ref: 'v6.2.0' + commit: 'sha1-7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5' + owner_id: 44036562 + repo_id: 192624594 + 'actions/setup-go@v7.0.0': + ref: 'v7.0.0' + commit: 'sha1-b7ad1dad31e06c5925ef5d2fc7ad053ef454303e' + owner_id: 44036562 + repo_id: 192624594 + 'actions/setup-node@v7.1.0': + ref: 'v7.1.0' + commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1' + owner_id: 44036562 + repo_id: 189476904 + 'actions/setup-python@v7.0.0': + ref: 'v7.0.0' + commit: 'sha1-5fda3b95a4ea91299a34e894583c3862153e4b97' + owner_id: 44036562 + repo_id: 192625525 + 'go-task/setup-task@v2.2.0': + ref: 'v2.2.0' + commit: 'sha1-a00fbb05ce67b35648be3c78cbc9fd85354c757e' + owner_id: 26048825 + repo_id: 1054141549 + 'golang/govulncheck-action@v1.1.0': + ref: 'v1.1.0' + commit: 'sha1-032d45514ae346b1db93c04b0c90b841c370344f' + owner_id: 4314092 + repo_id: 636411896 + uses: + - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' + - 'actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5' + 'golangci/golangci-lint-action@v9.3.0': + ref: 'v9.3.0' + commit: 'sha1-ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a' + owner_id: 35628013 + repo_id: 232539879 + 'goreleaser/goreleaser-action@v7.2.3': + ref: 'v7.2.3' + commit: 'sha1-f06c13b6b1a9625abc9e6e439d9c05a8f2190e94' + owner_id: 24697112 + repo_id: 209873006 + 'hustcer/setup-nu@v3.28': + ref: 'v3.28' + commit: 'sha1-95cd3bfe252450ef7d35dd9a7ddecf3484341134' + owner_id: 1161607 + repo_id: 486109928 + 'pnpm/action-setup@v6.0.10': + ref: 'v6.0.10' + commit: 'sha1-0977fd99725f1db4007ccb2928dbb4e90d06cc86' + owner_id: 21320719 + repo_id: 262289747 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6fc58d9c9d..022878f8aa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,6 +16,25 @@ permissions: contents: read jobs: + verify-actions-lock: + name: 🔒 Verify actions lockfile + runs-on: ubuntu-latest + steps: + - name: 📥 Checkout + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + + - name: ⬇️ Install actions-lock + run: gh extension install github/gh-actions-lock --pin v0.4.0 + env: + GH_TOKEN: ${{ github.token }} + + - name: 🔒 Verify actions lockfile + run: gh actions-lock --verify + env: + GH_TOKEN: ${{ github.token }} + build: name: 🔨 Build (${{ matrix.go-version }}) strategy: @@ -25,10 +44,10 @@ jobs: runs-on: ubuntu-latest steps: - name: 📥 Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: ⬇️ Setup Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + uses: actions/setup-go@v7.0.0 with: go-version: ${{ matrix.go-version }} @@ -45,15 +64,15 @@ jobs: runs-on: ${{ matrix.platform }} steps: - name: 📥 Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: ⬇️ Setup Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + uses: actions/setup-go@v7.0.0 with: go-version: ${{ matrix.go-version }} - name: ⬇️ Setup Task - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 + uses: go-task/setup-task@v2.2.0 - name: 🧪 Test run: task test --output group --output-group-begin '::group::{{.TASK}}' --output-group-end '::endgroup::' @@ -67,15 +86,15 @@ jobs: runs-on: ${{ matrix.platform }} steps: - name: 📥 Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: ⬇️ Setup Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + uses: actions/setup-go@v7.0.0 with: go-version: 1.27.x - name: ⬇️ Setup Task - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 + uses: go-task/setup-task@v2.2.0 # zsh and pwsh are preinstalled on the runners; only fish is missing # (plus zsh on the Linux image). @@ -90,7 +109,7 @@ jobs: # Nushell ships in no runner image and is not packaged by apt, so it comes # from its own release archives. - name: ⬇️ Install Nushell - uses: hustcer/setup-nu@95cd3bfe252450ef7d35dd9a7ddecf3484341134 # v3.28 + uses: hustcer/setup-nu@v3.28 with: version: "*" @@ -110,15 +129,15 @@ jobs: runs-on: ubuntu-latest steps: - name: 📥 Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: ⬇️ Setup Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + uses: actions/setup-go@v7.0.0 with: go-version: ${{ matrix.go-version }} - name: 🔍 Lint - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 + uses: golangci/golangci-lint-action@v9.3.0 with: version: v2.14.0 @@ -127,10 +146,10 @@ jobs: runs-on: ubuntu-latest steps: - name: 📥 Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: ⬇️ Setup Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@v7.0.0 with: python-version: 3.15 @@ -145,20 +164,20 @@ jobs: runs-on: ubuntu-latest steps: - name: 📥 Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 - name: ⬇️ Setup Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + uses: actions/setup-go@v7.0.0 with: go-version: 1.27.x - name: ⬇️ Setup Node - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + uses: actions/setup-node@v7.1.0 with: node-version: '24' - name: ⬇️ Setup pnpm - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + uses: pnpm/action-setup@v6.0.10 with: package_json_file: website/package.json @@ -201,7 +220,7 @@ jobs: permissions: pull-requests: read steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: script: | // Everything cmd/release overwrites. Adding a file is fine -- that @@ -234,4 +253,4 @@ jobs: name: 🛡️ Vulnerabilities runs-on: ubuntu-latest steps: - - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0 + - uses: golang/govulncheck-action@v1.1.0 diff --git a/.github/workflows/issue-awaiting-response.yml b/.github/workflows/issue-awaiting-response.yml index 73ed80feb5..08a4ca1f7d 100644 --- a/.github/workflows/issue-awaiting-response.yml +++ b/.github/workflows/issue-awaiting-response.yml @@ -11,7 +11,7 @@ jobs: issue-awaiting-response: runs-on: ubuntu-latest steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | diff --git a/.github/workflows/issue-closed.yml b/.github/workflows/issue-closed.yml index c78daf64ec..0b1b99ec4e 100644 --- a/.github/workflows/issue-closed.yml +++ b/.github/workflows/issue-closed.yml @@ -11,7 +11,7 @@ jobs: issue-closed: runs-on: ubuntu-latest steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | diff --git a/.github/workflows/issue-experiment.yml b/.github/workflows/issue-experiment.yml index ea62546d72..e0694ff77a 100644 --- a/.github/workflows/issue-experiment.yml +++ b/.github/workflows/issue-experiment.yml @@ -12,7 +12,7 @@ jobs: if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'proposal' runs-on: ubuntu-latest steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | @@ -26,7 +26,7 @@ jobs: if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'draft' runs-on: ubuntu-latest steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | @@ -40,7 +40,7 @@ jobs: if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'candidate' runs-on: ubuntu-latest steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | @@ -54,7 +54,7 @@ jobs: if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'stable' runs-on: ubuntu-latest steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | @@ -68,7 +68,7 @@ jobs: if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'released' runs-on: ubuntu-latest steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | @@ -88,7 +88,7 @@ jobs: if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'abandoned' runs-on: ubuntu-latest steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | @@ -108,7 +108,7 @@ jobs: if: github.event.issue_field.id == '6591' && github.event.issue_field_value.option.name == 'superseded' runs-on: ubuntu-latest steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | diff --git a/.github/workflows/issue-needs-triage.yml b/.github/workflows/issue-needs-triage.yml index f2396c1a5d..43948b03dd 100644 --- a/.github/workflows/issue-needs-triage.yml +++ b/.github/workflows/issue-needs-triage.yml @@ -11,7 +11,7 @@ jobs: issue-needs-triage: runs-on: ubuntu-latest steps: - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 + - uses: actions/github-script@v9.0.0 with: github-token: ${{secrets.GITHUB_TOKEN}} script: | diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml index 9764593469..fd94c9b25f 100644 --- a/.github/workflows/release-nightly.yml +++ b/.github/workflows/release-nightly.yml @@ -13,17 +13,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + uses: actions/setup-go@v7.0.0 with: go-version: 1.27.x - name: Run GoReleaser - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7 + uses: goreleaser/goreleaser-action@v7.2.3 with: distribution: goreleaser-pro version: latest diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 22004a642d..662c9d21ed 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,16 +14,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + uses: actions/setup-go@v7.0.0 with: go-version: 1.27.x - - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + - uses: actions/setup-node@v7.1.0 with: node-version: "24" registry-url: "https://registry.npmjs.org" @@ -32,10 +32,10 @@ jobs: run: npm install -g npm@latest - name: Install Task - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2 + uses: go-task/setup-task@v2.2.0 - name: Install pnpm - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + uses: pnpm/action-setup@v6.0.10 with: package_json_file: "website/package.json" @@ -54,7 +54,7 @@ jobs: run: go run ./cmd/release --notes > "${RUNNER_TEMP}/release-notes.md" - name: Run GoReleaser - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7 + uses: goreleaser/goreleaser-action@v7.2.3 with: distribution: goreleaser-pro version: latest diff --git a/website/src/next/docs/contributing.md b/website/src/next/docs/contributing.md index 24d3ff9770..c565778453 100644 --- a/website/src/next/docs/contributing.md +++ b/website/src/next/docs/contributing.md @@ -120,6 +120,23 @@ you to set breakpoints and step through the code. Otherwise, you can run `task package` which will generate a `.vsix` file that can be used to manually install the extension. +### Updating GitHub Actions dependencies + +GitHub Actions dependencies, including transitive actions, are pinned in +`.github/workflows/actions.lock`. After adding or removing a workflow or +changing a `uses:` reference, regenerate the lockfile with the authenticated +GitHub CLI: + +```shell +gh extension install github/gh-actions-lock +gh actions-lock +gh actions-lock --verify +``` + +Review and commit the workflow changes and the generated lockfile together. Do +not edit the lockfile by hand. CI verifies it against the workflows and upstream +repositories. Renovate regenerates it when updating action versions. + ### Updating documentation Task uses [Vitepress][vitepress] to host a documentation server. The code for