The action is pinned in the snippets, and the ref does not pin the tool - #106
Merged
Merged
Conversation
…the tool `test_repository_signals.py::test_every_action_is_pinned_to_a_commit` holds every `uses:` in this repository's own workflows to a full commit SHA. The five snippets this project publishes said `uses: CTRLRun/ctrlrun@main`, and three of them followed that line with a sentence telling the reader to pin. Recommending less than what you enforce on yourself is the shape a reader notices first, and a Marketplace listing would put it in front of more of them. All five now name `@v0.6.0`. The second half is the defect the first half hides. `install` defaults to `ctrlrun`, unpinned, so pinning the action ref pins the workflow steps and not the package they install: `@v0.6.0` runs whatever PyPI serves on the day the job runs. Nothing said so anywhere, and at a 0.5 -> 0.6 boundary that is a version somebody did not choose. The input's own description says it now, and so does every page that shows the pin. No behaviour changes: `action.yml`'s defaults, inputs and outputs are untouched.
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pre-tag work for 0.6.0, and a prerequisite for listing the action on the GitHub Marketplace.
Two things
1. The five published snippets said
@main.test_repository_signals.py::test_every_action_is_pinned_to_a_commitholds everyuses:in this repository's own workflows to a full commit SHA. The snippets this project hands to users named a branch — and three of the five followed that line with a sentence telling the reader to pin, which makes the inconsistency visible in a single screen. All five now name@v0.6.0.2. The ref does not pin the tool, and nothing said so.
installdefaults toctrlrun, unpinned. SoCTRLRun/ctrlrun@v0.6.0pins the workflow steps and installs whatever PyPI serves on the day the job runs. A reader who pins the action reasonably believes they pinned the thing being verified with, and they have not. At a 0.5 → 0.6 boundary that is a version nobody chose. Theinstallinput's own description says it now, and so does every page that shows the pin.Files
README.md,docs/verify.mddocs/verify/get-the-badge.mdx,docs/cookbook/verify-in-github-actions.mdx,docs/guides/verify-in-ci.mdxaction.yml— theinstallinput'sdescriptiononlyNo behaviour change
action.yml'sruns:, defaults, input names and output names are untouched, sotest_T118_the_action_is_a_composite_action_at_the_repository_rootis unaffected. Full suite green locally: 4112 passed, 45 skipped.Ordering
@v0.6.0names a tag that does not exist yet. That is deliberate and it is why this is pre-tag work: merge this, then tagv0.6.0from amainthat already contains it, so the tagged tree's docs point at the tag they ship in. Tagging first leaves 0.6.0 telling its readers to use@main.