From ab64f1a4cbc3e113475e9140befb8f54e788cff4 Mon Sep 17 00:00:00 2001 From: Teakowa <27560638+Teakowa@users.noreply.github.com> Date: Sun, 25 Oct 2026 06:32:39 +0800 Subject: [PATCH] ci: lint workflows and pin third-party actions to SHAs Call the shared actionlint workflow from ci.yml and wire it into ci-result.needs so workflow changes are linted in CI. Generalize ci-jobs.py so every unconditional job is required (previously only `paths` was recognized; any other unconditional job failed the check). Migrate every tag-pinned third-party action in the repository's workflows to a full commit SHA with the resolved tag as a comment, per the ci-platform mandate now covering actions/* explicitly. Refs wrightkit/.github#124 --- .github/workflows/ci.yml | 71 +++++++++++++++------------- .github/workflows/release-please.yml | 4 +- .github/workflows/release.yml | 50 ++++++++++---------- scripts/ci-jobs.py | 2 +- scripts/test-ci-jobs.py | 1 + 5 files changed, 67 insertions(+), 61 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3138591b..256abb49 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,6 +10,10 @@ permissions: contents: read jobs: + workflow-lint: + name: Workflow lint + uses: wrightkit/.github/.github/workflows/actionlint.yml@main + paths: name: Detect paths runs-on: ubuntu-latest @@ -23,7 +27,7 @@ jobs: agent_guide: ${{ steps.filter.outputs.agent_guide }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -35,7 +39,7 @@ jobs: - name: Filter paths id: filter - uses: dorny/paths-filter@v4 + uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 with: filters: | rust_core: @@ -79,10 +83,10 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Checkout skills - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: wrightkit/skills fetch-depth: 0 @@ -109,7 +113,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Rust uses: wrightkit/.github/.github/actions/setup-rust@main @@ -121,7 +125,7 @@ jobs: run: cargo build --locked -p wright-cli - name: Upload CLI artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: wright-cli-linux-stable-debug path: target/debug/wright @@ -160,17 +164,17 @@ jobs: expected_exit: 0 steps: - name: Checkout Wright - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Checkout workshop-rs - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: wrightkit/workshop-rs ref: f1f3c58f790e9aede9300ca6421698f2503f5f62 # v0.3.11 path: workshop-rs-pinned - name: Download CLI artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: wright-cli-linux-stable-debug path: target/debug @@ -241,7 +245,7 @@ jobs: timeout-minutes: 20 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Rust uses: wrightkit/.github/.github/actions/setup-rust@main @@ -249,7 +253,7 @@ jobs: toolchain: 1.97.1 cache-shared-key: linux-quality-stable-dev-test - name: Download CLI artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: wright-cli-linux-stable-debug path: target/debug @@ -285,7 +289,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout Wright - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Rust uses: wrightkit/.github/.github/actions/setup-rust@main @@ -297,7 +301,7 @@ jobs: # commit the integration tests were validated against (merged LPP v1, # PR wrightkit/language-provider-protocol#2 plus docs-only follow-ups). - name: Checkout LPP - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: wrightkit/language-provider-protocol ref: 416b293e26e6fb2d29061608a493a7aecd2ce14f @@ -325,7 +329,7 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Rust uses: wrightkit/.github/.github/actions/setup-rust@main @@ -333,7 +337,7 @@ jobs: toolchain: 1.97.1 - name: Download CLI artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: wright-cli-linux-stable-debug path: target/debug @@ -353,7 +357,7 @@ jobs: timeout-minutes: 20 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Rust uses: wrightkit/.github/.github/actions/setup-rust@main @@ -370,7 +374,7 @@ jobs: - name: Upload benchmark report if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: benchmark-report path: target/wright-bench-report.json @@ -396,10 +400,10 @@ jobs: - overwatch-ai-pve steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download CLI artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: wright-cli-linux-stable-debug path: target/debug @@ -415,7 +419,7 @@ jobs: --out "$RUNNER_TEMP/${{ matrix.project }}.json" - name: Upload shard run - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: metrics-shard-${{ matrix.project }} path: ${{ runner.temp }}/${{ matrix.project }}.json @@ -429,10 +433,10 @@ jobs: timeout-minutes: 10 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download shard runs - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: metrics-shard-* merge-multiple: true @@ -454,10 +458,10 @@ jobs: continue-on-error: true steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download CLI artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: wright-cli-linux-stable-debug path: target/debug @@ -472,7 +476,7 @@ jobs: - name: Upload latency record if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: metrics-latency path: target/metrics-latency.json @@ -493,7 +497,7 @@ jobs: - windows-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Rust uses: wrightkit/.github/.github/actions/setup-rust@main @@ -508,7 +512,7 @@ jobs: run: cargo build --locked -p wright-cli -p wright-lsp - name: Upload distribution binaries - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: wright-dist-cli-${{ matrix.os }} path: | @@ -542,10 +546,10 @@ jobs: channel: WinGet steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" @@ -560,7 +564,7 @@ jobs: run: winget settings --enable LocalManifestFiles - name: Download distribution binaries - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: wright-dist-cli-${{ matrix.os }} path: target/debug @@ -605,7 +609,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Rust uses: wrightkit/.github/.github/actions/setup-rust@main @@ -614,7 +618,7 @@ jobs: cache-shared-key: linux-wasm-stable-release - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: npm @@ -645,6 +649,7 @@ jobs: if: always() needs: - paths + - workflow-lint - rust-quality - wright-cli-build - workshop-integration @@ -661,7 +666,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Fail on failed, cancelled, or wrongly skipped jobs env: diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 65c9de43..1d2abfb3 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -22,7 +22,7 @@ jobs: steps: - name: Run release-please id: release - uses: googleapis/release-please-action@v5 + uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 with: token: ${{ secrets.GH_TOKEN }} config-file: release-please-config.json @@ -30,7 +30,7 @@ jobs: - name: Check out Release PR branch if: steps.release.outputs.prs_created == 'true' - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }} token: ${{ secrets.GH_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8e739b68..8b5a021a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -110,7 +110,7 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Check out repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ steps.resolve.outputs.commit }} @@ -182,13 +182,13 @@ jobs: EXT: ${{ matrix.ext }} steps: - name: Check out repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.release-identity.outputs.commit }} fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v7 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: python-version: "3.12" @@ -225,7 +225,7 @@ jobs: --extension "$EXT" - name: Upload target artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: wright-${{ matrix.target }} path: | @@ -246,12 +246,12 @@ jobs: RELEASE_COMMIT: ${{ needs.release-identity.outputs.commit }} steps: - name: Check out repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.release-identity.outputs.commit }} - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: npm @@ -287,7 +287,7 @@ jobs: --tarball "dist/wrightkit-core-${RELEASE_VERSION}.tgz" - name: Upload core package - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: wright-core-package path: dist/wrightkit-core-* @@ -305,7 +305,7 @@ jobs: RELEASE_COMMIT: ${{ needs.release-identity.outputs.commit }} steps: - name: Download target artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: wright-* path: release @@ -347,7 +347,7 @@ jobs: (cd verified && sha256sum wright-*.tar.gz wright-*.zip > SHA256SUMS) - name: Upload verified release assets - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: verified-release-assets path: verified/* @@ -365,13 +365,13 @@ jobs: RELEASE_TAG: ${{ needs.release-identity.outputs.tag }} steps: - name: Check out repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.release-identity.outputs.commit }} fetch-depth: 0 - name: Download verified release assets - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: verified-release-assets path: artifacts @@ -385,7 +385,7 @@ jobs: --attach-dir attach - name: Upload package manifests - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-manifests path: attach/* @@ -402,7 +402,7 @@ jobs: RELEASE_VERSION: ${{ needs.release-identity.outputs.version }} steps: - name: Check out repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.release-identity.outputs.commit }} - name: Set up Rust @@ -420,7 +420,7 @@ jobs: --wright target/release/wright --out "wright-agent-metrics-$RELEASE_VERSION.json" - name: Upload metrics artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: agent-metrics path: wright-agent-metrics-*.json @@ -438,17 +438,17 @@ jobs: RELEASE_TAG: ${{ needs.release-identity.outputs.tag }} steps: - name: Check out repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.release-identity.outputs.commit }} - name: Download Homebrew formula - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-manifests path: formula - name: Check out homebrew-tap - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: wrightkit/homebrew-tap ref: main @@ -473,19 +473,19 @@ jobs: environment: release steps: - name: Download verified release assets - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: verified-release-assets path: release - name: Download package manifests - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-manifests path: attach - name: Download agent-facing metrics - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: agent-metrics path: attach @@ -541,13 +541,13 @@ jobs: environment: release steps: - name: Download core package - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: wright-core-package path: package - name: Set up Node - uses: actions/setup-node@v7 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 registry-url: https://registry.npmjs.org @@ -581,14 +581,14 @@ jobs: AWS_DEFAULT_REGION: auto steps: - name: Check out repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.release-identity.outputs.commit }} - name: Verify AWS CLI config run: aws --version - name: Download verified release assets - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: verified-release-assets path: artifacts @@ -623,7 +623,7 @@ jobs: AWS_DEFAULT_REGION: auto steps: - name: Check out repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.release-identity.outputs.commit }} - name: Verify AWS CLI config diff --git a/scripts/ci-jobs.py b/scripts/ci-jobs.py index 192cca68..2248e4ba 100644 --- a/scripts/ci-jobs.py +++ b/scripts/ci-jobs.py @@ -18,7 +18,7 @@ def required_jobs(workflow, paths): if name == "ci-result" or job.get("continue-on-error") is True: continue condition = job.get("if") - if name == "paths" and condition is None: + if condition is None: required[name] = True continue if not isinstance(condition, str): diff --git a/scripts/test-ci-jobs.py b/scripts/test-ci-jobs.py index 7e8c119e..1405efe7 100644 --- a/scripts/test-ci-jobs.py +++ b/scripts/test-ci-jobs.py @@ -21,6 +21,7 @@ def test_actual_dependencies_match_gating_jobs(self): self.assertFalse(required["cli-behavior"]) self.assertNotIn("benchmark", required) self.assertNotIn("metrics-latency", required) + self.assertTrue(required["workflow-lint"]) def test_missing_dependency_fails(self): self.workflow["jobs"]["ci-result"]["needs"].remove("cli-behavior")