Repository navigation
Lock GitHub Actions workflows with an actions lockfile (#2096) - #2102
Open
rahul05ranjan wants to merge 2 commits into
Open
rahul05ranjan wants to merge 2 commits into
rahul05ranjan wants to merge 2 commits into
Conversation
Every workflow now pins its actions by version tag, with the tag-to-commit mapping machine-generated into .github/workflows/ actions.lock by gh actions-lock (github/gh-actions-lock v0.4.1), following https://hugovk.dev/blog/2026/lock-github-actions/. A new lockfile job in the zizmor workflow runs gh actions-lock --verify, failing when the lockfile is out of sync with the workflows or a locked pin no longer verifies upstream. Dependabot keeps the lockfile updated with its github-actions group. zizmor is bumped to 1.32.0, the first release that reads the lockfile: it accepts the tag pins only because actions.lock backs them. Co-authored-by: rahul05ranjan <11793455+rahul05ranjan@users.noreply.github.com>
rahul05ranjan
requested review from
niccokunzmann and
stevepiercy
as code owners
November 12, 2026 18:20
Contributor
|
Thanks for the pull request, @rahul05ranjan! A maintainer will review it shortly. |
github-actions
Bot
added
the
ai-suspicion
Contributor
|
One or more PR-quality checks did not pass. Review the PR Quality Checks summary in the workflow run for the failed checks and their details, then make any necessary updates. Checklist items may remain unchecked while work is in progress. Please tick each item as you complete it. If you used AI assistance, follow the project's Responsible AI use policy and provide the required disclosures. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| https://icalendar.readthedocs.io/en/stable/contribute/development.html#format-code | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| - uses: actions/checkout@v7.0.1 |
| include: ${{ steps.set-matrix.outputs.include }} | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| - uses: actions/checkout@v7.0.1 |
| TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }} | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| - uses: actions/checkout@v7.0.1 |
| name: github-release | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| - uses: actions/checkout@v7.0.1 |
| - uses: actions/checkout@v7.0.1 | ||
| - name: Create GitHub release from tag | ||
| uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 | ||
| uses: ncipollo/release-action@v1.21.0 |
zizmor 1.32.0 (the first release that reads the actions lockfile) requires Python >= 3.11, while icalendar supports >= 3.10. uv therefore failed to resolve the dev group on the 3.10 leg of every job (venv creation aborted before any test ran). Mark the pin so it only applies where zizmor can install; the zizmor workflow itself still pip-installs 1.32.0 directly. Verified with `uv lock`: the dev and docs groups now resolve across the full requires-python range, with zizmor carrying the python_full_version >= '3.11' marker. Co-authored-by: rahul05ranjan <11793455+rahul05ranjan@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2096.
Per hugovk.dev's write-up of the new GitHub Actions workflow lockfiles:
uses: actions/checkout@v7.0.1— with the tag-to-commit mapping machine-generated into.github/workflows/actions.lockbygh actions-lock(github/gh-actions-lock v0.4.1). The lockfile carries the commit, owner and repo ids for each dependency, exactly as the tool emits it; it is not hand-edited.lockfilejob in the zizmor workflow runsgh actions-lock --verify, failing when the lockfile is out of sync with the workflows or a locked pin no longer verifies upstream — the validation GitHub recommends for CI. Itsgh extension install github/gh-actions-lock --pin v0.4.1pins the extension itself.github-actionsgroup, so the periodic bumps keepactions.lockupdated alongside the workflows.pyproject.tomland the workflow (v1.32.0 is the first release to read the lockfile): it accepts the tag pins only becauseactions.lockbacks them.SHA→tag conversions are limited to what
gh actions-lockproduced — no other workflow edits. A news fragment (news/2096.internal) is included.I used AI to assist me with this change.