-
-
Notifications
You must be signed in to change notification settings - Fork 0
fix(ci): unbreak workflow YAML and add a complete actions.lock #33
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,126 @@ | ||
| # This file is machine-generated by `gh actions-lock`. | ||
| # Do not edit by hand; run `gh actions-lock` to update. | ||
| # Docs: https://gh.io/actions-lockfile | ||
| version: 'v0.0.2' | ||
| workflows: | ||
| '.github/workflows/governance.yml': [] | ||
| '.github/workflows/hypatia-scan.yml': [] | ||
| '.github/workflows/mirror.yml': [] | ||
| '.github/workflows/rust-ci.yml': [] | ||
| '.github/workflows/scorecard.yml': [] | ||
| '.github/workflows/secret-scanner.yml': [] | ||
| '.github/workflows/boj-build.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| '.github/workflows/codeql.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| - 'github/codeql-action@v4.37.7' | ||
| '.github/workflows/container-build.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| '.github/workflows/dependabot-automerge.yml': | ||
| - 'dependabot/fetch-metadata@v3.1.0' | ||
| '.github/workflows/dogfood-gate.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| '.github/workflows/estate-rules.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| '.github/workflows/guix-policy.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| '.github/workflows/instant-sync.yml': | ||
| - 'peter-evans/repository-dispatch@v4.0.1' | ||
| '.github/workflows/openssf-compliance.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| '.github/workflows/pages.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| - 'actions/deploy-pages@v5.0.0' | ||
| - 'actions/upload-pages-artifact@v5.0.0' | ||
| '.github/workflows/push-email-notify.yml': | ||
| - 'dawidd6/action-send-mail@v3.12.0' | ||
| '.github/workflows/quality.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| - 'editorconfig-checker/action-editorconfig-checker@v2.2.0' | ||
| '.github/workflows/release.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| - 'actions/upload-artifact@v7.0.1' | ||
| - 'softprops/action-gh-release@v3.0.2' | ||
| '.github/workflows/rhodibot.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| '.github/workflows/runtime-policy.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| '.github/workflows/security-policy.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| '.github/workflows/static-analysis-gate.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| - 'actions/download-artifact@v8.0.1' | ||
| - 'actions/upload-artifact@v7.0.1' | ||
| - 'erlef/setup-beam@v1.24.1' | ||
| '.github/workflows/wellknown-enforcement.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| '.github/workflows/workflow-linter.yml': | ||
| - 'actions/checkout@v7.0.1' | ||
| dependencies: | ||
| 'actions/checkout@v7.0.1': | ||
| ref: 'v7.0.1' | ||
| commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' | ||
| owner_id: 44036562 | ||
| repo_id: 197814629 | ||
| 'actions/deploy-pages@v5.0.0': | ||
| ref: 'v5.0.0' | ||
| commit: 'sha1-cd2ce8fcbc39b97be8ca5fce6e763baed58fa128' | ||
| owner_id: 44036562 | ||
| repo_id: 438112499 | ||
| 'actions/download-artifact@v8.0.1': | ||
| ref: 'v8.0.1' | ||
| commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' | ||
| owner_id: 44036562 | ||
| repo_id: 192626254 | ||
| 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': | ||
| ref: 'v7.0.0' | ||
| commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' | ||
| owner_id: 44036562 | ||
| repo_id: 192625955 | ||
| 'actions/upload-artifact@v7.0.1': | ||
| ref: 'v7.0.1' | ||
| commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' | ||
| owner_id: 44036562 | ||
| repo_id: 192625955 | ||
| 'actions/upload-pages-artifact@v5.0.0': | ||
| ref: 'v5.0.0' | ||
| commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' | ||
| owner_id: 44036562 | ||
| repo_id: 496012378 | ||
| uses: | ||
| - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' | ||
| 'dawidd6/action-send-mail@v3.12.0': | ||
| ref: 'v3.12.0' | ||
| commit: 'sha1-0bbdab096651ee93f37ec02383e088183d41ff0b' | ||
| owner_id: 9713907 | ||
| repo_id: 222439721 | ||
| 'dependabot/fetch-metadata@v3.1.0': | ||
| ref: 'v3.1.0' | ||
| commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98' | ||
| owner_id: 27347476 | ||
| repo_id: 371068214 | ||
| 'editorconfig-checker/action-editorconfig-checker@v2.2.0': | ||
| ref: 'v2.2.0' | ||
| commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c' | ||
| owner_id: 26415196 | ||
| repo_id: 297874902 | ||
| 'erlef/setup-beam@v1.24.1': | ||
| ref: 'v1.24.1' | ||
| commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' | ||
| owner_id: 47606891 | ||
| repo_id: 331103973 | ||
| 'github/codeql-action@v4.37.7': | ||
| ref: 'v4.37.7' | ||
| commit: 'sha1-ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd' | ||
| owner_id: 9919 | ||
| repo_id: 259445878 | ||
| 'peter-evans/repository-dispatch@v4.0.1': | ||
| ref: 'v4.0.1' | ||
| commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' | ||
| owner_id: 18365890 | ||
| repo_id: 220359305 | ||
| 'softprops/action-gh-release@v3.0.2': | ||
| ref: 'v3.0.2' | ||
| commit: 'sha1-3d0d9888cb7fd7b750713d6e236d1fcb99157228' | ||
| owner_id: 2242 | ||
| repo_id: 204253808 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,5 @@ | ||
| # SPDX-License-Identifier: MPL-2.0 | ||
| # This workflow is managed by gh actions-lock. | ||
| # Instant Forge Sync - Triggers propagation to all forges on push/release | ||
| name: Instant Sync | ||
| on: | ||
|
|
@@ -29,7 +30,7 @@ | |
| fi | ||
| - name: Trigger Propagation | ||
| if: steps.gate.outputs.present == 'true' | ||
| uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3 | ||
| uses: peter-evans/repository-dispatch@v4.0.1 | ||
|
Check failure on line 33 in .github/workflows/instant-sync.yml
|
||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔴 HIGH RISK Pinning to a tag instead of a commit SHA allows the underlying code to change without notice. Use the immutable commit SHA instead. Try running the following prompt in your IDE agent:
|
||
| with: | ||
| token: ${{ secrets.FARM_DISPATCH_TOKEN }} | ||
| repository: hyperpolymath/.git-private-farm | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
Ensure this action is pinned to an immutable commit SHA. This prevents external changes to the action from executing in your privileged workflow.
Try running the following prompt in your IDE agent:
See Issue in Codacy