From b6a862698e0505c25d24d11654788b2e8aac8098 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= Date: Fri, 30 Oct 2026 12:32:08 +0100 Subject: [PATCH 1/2] Use GitHub Actions workflow lockfile This is preferable to pinning the SHA-256 with a version comment, because the version will now actually be validated. see https://github.blog/changelog/2026-10-28-github-actions-workflow-lockfiles-are-generally-available/ --- .github/workflows/actions.lock | 62 +++++++++++++++++++++++++++++++ .github/workflows/agent-image.yml | 14 +++---- .github/workflows/ci.yml | 12 +++--- .github/workflows/release.yml | 6 +-- 4 files changed, 78 insertions(+), 16 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..208f99c --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,62 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/agent-image.yml': + - 'actions/attest-build-provenance@v4.2.2' + - 'actions/checkout@v7.0.1' + - 'docker/build-push-action@v7.4.0' + - 'docker/login-action@v4.6.0' + - 'docker/setup-buildx-action@v4.4.1' + - 'docker/setup-qemu-action@v4.4.0' + '.github/workflows/ci.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-go@v7.0.0' + '.github/workflows/release.yml': + - 'actions/attest-build-provenance@v4.2.2' + - 'actions/checkout@v7.0.1' + - 'actions/setup-go@v7.0.0' +dependencies: + 'actions/attest-build-provenance@v4.2.2': + ref: 'v4.2.2' + commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8' + owner_id: 44036562 + repo_id: 760702757 + uses: + - 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d' + 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d': + ref: 'v4.2.1' + commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d' + owner_id: 44036562 + repo_id: 760701061 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/setup-go@v7.0.0': + ref: 'v7.0.0' + commit: 'sha1-b7ad1dad31e06c5925ef5d2fc7ad053ef454303e' + owner_id: 44036562 + repo_id: 192624594 + 'docker/build-push-action@v7.4.0': + ref: 'v7.4.0' + commit: 'sha1-c3c9e263c25d99ce0380d002d59b67737d91b0dc' + owner_id: 5429470 + repo_id: 241092383 + 'docker/login-action@v4.6.0': + ref: 'v4.6.0' + commit: 'sha1-dbcb813823bdd20940b903addbd779551569679f' + owner_id: 5429470 + repo_id: 287743349 + 'docker/setup-buildx-action@v4.4.1': + ref: 'v4.4.1' + commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069' + owner_id: 5429470 + repo_id: 288485773 + 'docker/setup-qemu-action@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-99012661954931238ded8c8b007157a8430204e1' + owner_id: 5429470 + repo_id: 288487894 diff --git a/.github/workflows/agent-image.yml b/.github/workflows/agent-image.yml index ec250c7..3491ebe 100644 --- a/.github/workflows/agent-image.yml +++ b/.github/workflows/agent-image.yml @@ -30,18 +30,18 @@ jobs: - claude - codex steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + - uses: docker/setup-qemu-action@v4.4.0 + - uses: docker/setup-buildx-action@v4.4.1 + - uses: docker/login-action@v4.6.0 if: ${{ github.event_name != 'pull_request' }} with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 + - uses: docker/build-push-action@v7.4.0 id: push with: context: docker/agent @@ -52,7 +52,7 @@ jobs: tags: | ghcr.io/${{ github.repository }}-agent:${{ matrix.agent }} ghcr.io/${{ github.repository }}-agent:${{ matrix.agent }}-${{ github.sha }} - - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 + - uses: actions/attest-build-provenance@v4.2.2 if: ${{ github.event_name != 'pull_request' }} with: subject-name: ghcr.io/${{ github.repository }}-agent @@ -69,7 +69,7 @@ jobs: contents: write pull-requests: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 - name: Open a pull request pinning the new digests env: GH_TOKEN: ${{ github.token }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 656d4a2..987773c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,10 +18,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + - uses: actions/setup-go@v7.0.0 with: go-version-file: go.mod - name: gofmt @@ -42,10 +42,10 @@ jobs: - { package: ./internal/report, name: FuzzClues } - { package: ./internal/repo, name: FuzzReadFileStaysInTrackedFiles } steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + - uses: actions/setup-go@v7.0.0 with: go-version-file: go.mod - run: go test ${{ matrix.target.package }} -run '^$' -fuzz '^${{ matrix.target.name }}$' -fuzztime 60s @@ -60,10 +60,10 @@ jobs: - claude - codex steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + - uses: actions/setup-go@v7.0.0 with: go-version-file: go.mod - run: docker info diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 26fca96..3a10b42 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,10 +16,10 @@ jobs: id-token: write attestations: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + - uses: actions/setup-go@v7.0.0 with: go-version-file: go.mod - name: Build @@ -34,7 +34,7 @@ jobs: done done # The action only runs a released binary attested by this workflow for the commit it was given. - - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 + - uses: actions/attest-build-provenance@v4.2.2 with: subject-path: dist/tamis-* - name: Publish the release From cb2471e3bfde5e807cd751c79ef4f14d93907164 Mon Sep 17 00:00:00 2001 From: Alexandre Daubois Date: Fri, 30 Oct 2026 12:41:45 +0100 Subject: [PATCH 2/2] Check the actions lockfile in CI --- .github/workflows/ci.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 987773c..e525fa0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -31,6 +31,21 @@ jobs: - run: go vet ./... - run: go tool gotestsum --format github-actions -- -race -count=1 ./... + # release.yml only runs on tags, so a stale lockfile entry would otherwise break the next release. + actions-lock: + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - run: gh extension install github/gh-actions-lock --pin v0.4.0 + env: + GH_TOKEN: ${{ github.token }} + - run: gh actions-lock --verify + env: + GH_TOKEN: ${{ github.token }} + fuzz: runs-on: ubuntu-latest timeout-minutes: 10