Skip to content

Commit 82b19ae

Browse files
dominic-clerkclaude
dominic-clerk
and
claude
authored
ci(repo): add GitHub Actions lockfile and fix two unverifiable pins (#10251)
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
1 parent c04d22f commit 82b19ae

21 files changed

Lines changed: 379 additions & 114 deletions

‎.changeset/pin-actions-lockfile.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
---

‎.github/actionlint.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,9 @@ self-hosted-runner:
77
labels:
88
- blacksmith-8vcpu-ubuntu-2204
99
- blacksmith-6vcpu-macos-26
10+
11+
paths:
12+
.github/workflows/**/*.yml:
13+
ignore:
14+
# `$/` self-repo action syntax; unsupported by actionlint 1.7.12 (rhysd/actionlint#711)
15+
- 'specifying action "\$/[^"]*" in invalid format because ref is missing'

‎.github/actions/init-blacksmith/action.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ runs:
4848
steps:
4949
- name: Configure Turborepo
5050
id: turbo
51-
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
51+
uses: actions/github-script@v7.1.0
5252
env:
5353
# envs are required to pass inputs to the script
5454
CACHE: ${{ inputs.turbo-cache }}
@@ -110,10 +110,10 @@ runs:
110110
run: echo $TURBO_ARGS
111111

112112
- name: Install PNPM
113-
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
113+
uses: pnpm/action-setup@v4.3.0
114114

115115
- name: Setup NodeJS ${{ inputs.node-version }}
116-
uses: useblacksmith/setup-node@65c6ca86fdeb0ab3d85e78f57e4f6a7e4780b391 # v5
116+
uses: useblacksmith/setup-node@v5.0.4
117117
with:
118118
cache: ${{ inputs.cache-enabled == 'true' && 'pnpm' || '' }}
119119
node-version: ${{ inputs.node-version }}
@@ -139,7 +139,7 @@ runs:
139139
140140
- name: Cache Playwright Binaries
141141
if: inputs.playwright-enabled == 'true' && inputs.cache-enabled == 'true'
142-
uses: useblacksmith/cache@71c7c918062ba3861252d84b07fe5ab2a6b467a6 # v5
142+
uses: useblacksmith/cache@v5
143143
id: playwright-cache
144144
with:
145145
path: ~/.cache/ms-playwright

‎.github/actions/init/action.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ runs:
4848
steps:
4949
- name: Configure Turborepo
5050
id: turbo
51-
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
51+
uses: actions/github-script@v7.1.0
5252
env:
5353
# envs are required to pass inputs to the script
5454
CACHE: ${{ inputs.turbo-cache }}
@@ -110,10 +110,10 @@ runs:
110110
run: echo $TURBO_ARGS
111111

112112
- name: Install PNPM
113-
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
113+
uses: pnpm/action-setup@v4.3.0
114114

115115
- name: Setup NodeJS ${{ inputs.node-version }}
116-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
116+
uses: actions/setup-node@v4.4.0
117117
with:
118118
cache: ${{ inputs.cache-enabled == 'true' && 'pnpm' || '' }}
119119
node-version: ${{ inputs.node-version }}
@@ -139,7 +139,7 @@ runs:
139139
140140
- name: Cache Playwright Binaries
141141
if: inputs.playwright-enabled == 'true' && inputs.cache-enabled == 'true'
142-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
142+
uses: actions/cache@v4.3.0
143143
id: playwright-cache
144144
with:
145145
path: ~/.cache/ms-playwright

‎.github/workflows/actionlint.yml‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
timeout-minutes: ${{ vars.TIMEOUT_MINUTES_SHORT && fromJSON(vars.TIMEOUT_MINUTES_SHORT) || 5 }}
2525
steps:
2626
- name: Checkout repo
27-
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
27+
uses: actions/checkout@v4.4.0
2828
with:
2929
persist-credentials: false
3030
show-progress: false
@@ -41,3 +41,26 @@ jobs:
4141
SHELLCHECK_OPTS: --exclude=SC2086,SC2129,SC2162
4242
with:
4343
args: -color
44+
45+
actions-lock:
46+
name: Verify actions lockfile
47+
runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
48+
timeout-minutes: ${{ vars.TIMEOUT_MINUTES_SHORT && fromJSON(vars.TIMEOUT_MINUTES_SHORT) || 5 }}
49+
steps:
50+
- name: Checkout repo
51+
uses: actions/checkout@v4.4.0
52+
with:
53+
persist-credentials: false
54+
show-progress: false
55+
sparse-checkout: .github
56+
sparse-checkout-cone-mode: false
57+
58+
- name: Install gh-actions-lock
59+
env:
60+
GH_TOKEN: ${{ github.token }}
61+
run: gh extension install github/gh-actions-lock --pin v0.2.0
62+
63+
- name: Verify every workflow dependency is locked
64+
env:
65+
GH_TOKEN: ${{ github.token }}
66+
run: gh actions-lock --verify

‎.github/workflows/actions.lock‎

Lines changed: 229 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,229 @@
1+
# This file is machine-generated by `gh actions-lock`.
2+
# Do not edit by hand; run `gh actions-lock` to update.
3+
# Docs: https://gh.io/actions-lockfile
4+
version: 'v0.0.3'
5+
workflows:
6+
'.github/workflows/actionlint.yml':
7+
- 'actions/checkout@v4.4.0'
8+
'.github/workflows/api-changes.yml':
9+
- 'actions/checkout@v4.4.0'
10+
- 'actions/github-script@v7.1.0'
11+
- 'actions/upload-artifact@v4.6.2'
12+
- 'clerk/break-check@v0.6.0'
13+
- 'pnpm/action-setup@v4.3.0'
14+
- 'useblacksmith/cache@v5'
15+
- 'useblacksmith/setup-node@v5.0.4'
16+
'.github/workflows/ci.yml':
17+
- 'actions-cool/check-user-permission@v2.4.0'
18+
- 'actions/checkout@v4.4.0'
19+
- 'actions/github-script@v7.1.0'
20+
- 'actions/upload-artifact@v4.6.2'
21+
- 'pnpm/action-setup@v4.3.0'
22+
- 'useblacksmith/cache@v5'
23+
- 'useblacksmith/setup-node@v5.0.4'
24+
'.github/workflows/e2e-cleanups.yml':
25+
- 'actions/cache@v4.3.0'
26+
- 'actions/checkout@v4.4.0'
27+
- 'actions/github-script@v7.1.0'
28+
- 'actions/setup-node@v4.4.0'
29+
- 'pnpm/action-setup@v4.3.0'
30+
'.github/workflows/e2e-staging.yml':
31+
- 'actions/checkout@v4.4.0'
32+
- 'actions/github-script@v7.1.0'
33+
- 'actions/upload-artifact@v4.6.2'
34+
- 'pnpm/action-setup@v4.3.0'
35+
- 'slackapi/slack-github-action@v1.27.1'
36+
- 'useblacksmith/cache@v5'
37+
- 'useblacksmith/setup-node@v5.0.4'
38+
'.github/workflows/electron-passkeys.yml':
39+
- 'actions/checkout@v4.4.0'
40+
- 'actions/download-artifact@v4.3.0'
41+
- 'actions/setup-node@v4.4.0'
42+
- 'actions/upload-artifact@v4.6.2'
43+
- 'dtolnay/rust-toolchain@v1'
44+
- 'pnpm/action-setup@v4.3.0'
45+
- 'swatinem/rust-cache@v2.9.2'
46+
'.github/workflows/expo-native-build.yml':
47+
- 'actions/cache@v4.3.0'
48+
- 'actions/checkout@v4.4.0'
49+
- 'actions/setup-java@v4.9.1'
50+
- 'actions/setup-node@v4.4.0'
51+
- 'actions/upload-artifact@v4.6.2'
52+
- 'gradle/actions@v6.3.0'
53+
- 'pnpm/action-setup@v4.3.0'
54+
- 'reactivecircus/android-emulator-runner@v2.38.0'
55+
'.github/workflows/labeler-apply.yml':
56+
- 'actions/checkout@v4.4.0'
57+
- 'actions/download-artifact@v4.3.0'
58+
- 'actions/github-script@v7.1.0'
59+
- 'actions/labeler@v6.2.0'
60+
'.github/workflows/labeler.yml':
61+
- 'actions/upload-artifact@v4.6.2'
62+
'.github/workflows/lock-threads.yml':
63+
- 'actions/stale@v9.1.0'
64+
- 'dessant/lock-threads@v4.0.1'
65+
'.github/workflows/major-version-check.yml':
66+
- 'actions/github-script@v7.1.0'
67+
'.github/workflows/nightly-checks.yml':
68+
- 'actions/cache@v4.3.0'
69+
- 'actions/checkout@v4.4.0'
70+
- 'actions/github-script@v7.1.0'
71+
- 'actions/setup-node@v4.4.0'
72+
- 'actions/upload-artifact@v4.6.2'
73+
- 'pnpm/action-setup@v4.3.0'
74+
- 'ravsamhq/notify-slack-action@1.10.0'
75+
'.github/workflows/pr-title-linter.yml':
76+
- 'actions/checkout@v4.4.0'
77+
'.github/workflows/release-preflight.yml':
78+
- 'actions/cache@v4.3.0'
79+
- 'actions/checkout@v4.4.0'
80+
- 'actions/github-script@v7.1.0'
81+
- 'actions/setup-node@v4.4.0'
82+
- 'actions/upload-artifact@v4.6.2'
83+
- 'pnpm/action-setup@v4.3.0'
84+
'.github/workflows/release.yml':
85+
- 'actions/cache@v4.3.0'
86+
- 'actions/checkout@v4.4.0'
87+
- 'actions/github-script@v7.1.0'
88+
- 'actions/setup-node@v4.4.0'
89+
- 'changesets/action@v1.8.0'
90+
- 'dawidd6/action-download-artifact@v21'
91+
- 'peter-evans/create-or-update-comment@v3.1.0'
92+
- 'pnpm/action-setup@v4.3.0'
93+
- 'slackapi/slack-github-action@v1.27.1'
94+
'.github/workflows/validate-renovate-config.yml':
95+
- 'actions/checkout@v4.4.0'
96+
dependencies:
97+
'actions-cool/check-user-permission@v2.4.0':
98+
ref: 'v2.4.0'
99+
commit: 'sha1-c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e'
100+
owner_id: 73879334
101+
repo_id: 344485868
102+
'actions/cache@v4.3.0':
103+
ref: 'v4.3.0'
104+
commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'
105+
owner_id: 44036562
106+
repo_id: 215566462
107+
'actions/checkout@v4.4.0':
108+
ref: 'v4.4.0'
109+
commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
110+
owner_id: 44036562
111+
repo_id: 197814629
112+
'actions/download-artifact@v4.3.0':
113+
ref: 'v4.3.0'
114+
commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
115+
owner_id: 44036562
116+
repo_id: 192626254
117+
'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3':
118+
ref: 'v9.0.0'
119+
commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
120+
owner_id: 44036562
121+
repo_id: 205262760
122+
'actions/github-script@v7.1.0':
123+
ref: 'v7.1.0'
124+
commit: 'sha1-f28e40c7f34bde8b3046d885e986cb6290c5673b'
125+
owner_id: 44036562
126+
repo_id: 205262760
127+
'actions/labeler@v6.2.0':
128+
ref: 'v6.2.0'
129+
commit: 'sha1-b8dd2d9be0f68b860e7dae5dae7d772984eacd6d'
130+
owner_id: 44036562
131+
repo_id: 177139928
132+
'actions/setup-java@v4.9.1':
133+
ref: 'v4.9.1'
134+
commit: 'sha1-cf277c60eb25467037889841efdb72551f06f6c3'
135+
owner_id: 44036562
136+
repo_id: 196057608
137+
'actions/setup-node@v4.4.0':
138+
ref: 'v4.4.0'
139+
commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
140+
owner_id: 44036562
141+
repo_id: 189476904
142+
'actions/stale@v9.1.0':
143+
ref: 'v9.1.0'
144+
commit: 'sha1-5bef64f19d7facfb25b37b414482c7164d639639'
145+
owner_id: 44036562
146+
repo_id: 200437066
147+
'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02':
148+
ref: 'v4.6.2'
149+
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
150+
owner_id: 44036562
151+
repo_id: 192625955
152+
'actions/upload-artifact@v4.6.2':
153+
ref: 'v4.6.2'
154+
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
155+
owner_id: 44036562
156+
repo_id: 192625955
157+
'changesets/action@v1.8.0':
158+
ref: 'v1.8.0'
159+
commit: 'sha1-63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b'
160+
owner_id: 51163350
161+
repo_id: 202093906
162+
'clerk/break-check@v0.6.0':
163+
ref: 'v0.6.0'
164+
commit: 'sha1-92be9cc726c848b9567c7b869e9b11dc761ddd6e'
165+
owner_id: 49538330
166+
repo_id: 1140987013
167+
uses:
168+
- 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3'
169+
- 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
170+
'dawidd6/action-download-artifact@v21':
171+
ref: 'v21'
172+
commit: 'sha1-b6e2e70617bc3265edd6dab6c906732b2f1ae151'
173+
owner_id: 9713907
174+
repo_id: 239218448
175+
'dessant/lock-threads@v4.0.1':
176+
ref: 'v4.0.1'
177+
commit: 'sha1-be8aa5be94131386884a6da4189effda9b14aa21'
178+
owner_id: 7513068
179+
repo_id: 113918130
180+
'dtolnay/rust-toolchain@v1':
181+
ref: 'v1'
182+
commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
183+
owner_id: 1940490
184+
repo_id: 260749683
185+
'gradle/actions@v6.3.0':
186+
ref: 'v6.3.0'
187+
commit: 'sha1-9c971963bec38e04b3d30dcc455b5382be2fdbfb'
188+
owner_id: 124156
189+
repo_id: 743626948
190+
'peter-evans/create-or-update-comment@v3.1.0':
191+
ref: 'v3.1.0'
192+
commit: 'sha1-23ff15729ef2fc348714a3bb66d2f655ca9066f2'
193+
owner_id: 18365890
194+
repo_id: 223708643
195+
'pnpm/action-setup@v4.3.0':
196+
ref: 'v4.3.0'
197+
commit: 'sha1-b906affcce14559ad1aafd4ab0e942779e9f58b1'
198+
owner_id: 21320719
199+
repo_id: 262289747
200+
'ravsamhq/notify-slack-action@1.10.0':
201+
ref: '1.10.0'
202+
commit: 'sha1-4ed28566c2bdcdaee6dca2b46b9666d01b4ed8a4'
203+
owner_id: 56475783
204+
repo_id: 280818415
205+
'reactivecircus/android-emulator-runner@v2.38.0':
206+
ref: 'v2.38.0'
207+
commit: 'sha1-a421e43855164a8197daf9d8d40fe71c6996bb0d'
208+
owner_id: 51352484
209+
repo_id: 219782401
210+
'slackapi/slack-github-action@v1.27.1':
211+
ref: 'v1.27.1'
212+
commit: 'sha1-fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3'
213+
owner_id: 6962987
214+
repo_id: 306439799
215+
'swatinem/rust-cache@v2.9.2':
216+
ref: 'v2.9.2'
217+
commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
218+
owner_id: 580492
219+
repo_id: 298565987
220+
'useblacksmith/cache@v5':
221+
ref: 'v5'
222+
commit: 'sha1-71c7c918062ba3861252d84b07fe5ab2a6b467a6'
223+
owner_id: 156274793
224+
repo_id: 746418836
225+
'useblacksmith/setup-node@v5.0.4':
226+
ref: 'v5.0.4'
227+
commit: 'sha1-65c6ca86fdeb0ab3d85e78f57e4f6a7e4780b391'
228+
owner_id: 156274793
229+
repo_id: 753445610

‎.github/workflows/api-changes.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -92,14 +92,14 @@ jobs:
9292

9393
steps:
9494
- name: Checkout Repo
95-
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
95+
uses: actions/checkout@v4.4.0
9696
with:
9797
persist-credentials: false
9898
filter: 'blob:none'
9999
show-progress: false
100100

101101
- name: Setup
102-
uses: ./.github/actions/init-blacksmith
102+
uses: $/.github/actions/init-blacksmith
103103
with:
104104
cache-enabled: true
105105
turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -115,7 +115,7 @@ jobs:
115115
--output "$GITHUB_WORKSPACE/.api-snapshots-baseline"
116116
117117
- name: Upload baseline artifact
118-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
118+
uses: actions/upload-artifact@v4.6.2
119119
with:
120120
name: break-check-baseline
121121
path: .api-snapshots-baseline
@@ -144,7 +144,7 @@ jobs:
144144

145145
steps:
146146
- name: Checkout Repo
147-
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
147+
uses: actions/checkout@v4.4.0
148148
with:
149149
# Check out the PR head commit, not the refs/pull/N/merge ref that
150150
# checkout resolves by default (it absorbs base-branch drift, so once
@@ -161,7 +161,7 @@ jobs:
161161
show-progress: false
162162

163163
- name: Setup
164-
uses: ./.github/actions/init-blacksmith
164+
uses: $/.github/actions/init-blacksmith
165165
with:
166166
cache-enabled: true
167167
turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -176,7 +176,7 @@ jobs:
176176
run: echo "BREAK_CHECK_FILTERS=$BREAK_CHECK_FILTERS" >> "$GITHUB_ENV"
177177

178178
- name: Break Check
179-
uses: clerk/break-check@92be9cc726c848b9567c7b869e9b11dc761ddd6e # v0.6.0
179+
uses: clerk/break-check@v0.6.0
180180
with:
181181
break-check-version: '0.6.0'
182182
# The PR head is already checked out, so build it in place rather than

0 commit comments

Comments
 (0)