From 4b590791ec99082370ecd9e64d4224aab73f6110 Mon Sep 17 00:00:00 2001 From: Rahul Ranjan Date: Thu, 12 Nov 2026 18:20:25 +0000 Subject: [PATCH 1/2] Lock GitHub Actions workflows with an actions lockfile (#2096) Every workflow now pins its actions by version tag, with the tag-to-commit mapping machine-generated into .github/workflows/ actions.lock by gh actions-lock (github/gh-actions-lock v0.4.1), following https://hugovk.dev/blog/2026/lock-github-actions/. A new lockfile job in the zizmor workflow runs gh actions-lock --verify, failing when the lockfile is out of sync with the workflows or a locked pin no longer verifies upstream. Dependabot keeps the lockfile updated with its github-actions group. zizmor is bumped to 1.32.0, the first release that reads the lockfile: it accepts the tag pins only because actions.lock backs them. Co-authored-by: rahul05ranjan <11793455+rahul05ranjan@users.noreply.github.com> --- .github/workflows/actions.lock | 86 +++++++++++++++++++++++++++++ .github/workflows/agent-scan.yml | 2 +- .github/workflows/cifuzz.yml | 4 +- .github/workflows/documentation.yml | 4 +- .github/workflows/pr-quality.yml | 2 +- .github/workflows/ruff.yml | 4 +- .github/workflows/tests.yml | 28 +++++----- .github/workflows/zizmor.yml | 26 ++++++++- news/2096.internal | 1 + pyproject.toml | 2 +- 10 files changed, 133 insertions(+), 26 deletions(-) create mode 100644 .github/workflows/actions.lock create mode 100644 news/2096.internal diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 000000000..64946868e --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,86 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/agent-scan.yml': + - 'matteogabriele/agentscan-action@v2.5.0' + '.github/workflows/cifuzz.yml': + - 'actions/upload-artifact@v7.0.2' + - 'github/codeql-action@v4.39.3' + - 'google/oss-fuzz@06a694ed8ee65428f29d220a001681a19ccde657' + '.github/workflows/documentation.yml': + - 'actions/checkout@v7.0.1' + - 'astral-sh/setup-uv@v10.3.3' + '.github/workflows/pr-quality.yml': + - 'peakoss/anti-slop@v0.3.0' + '.github/workflows/ruff.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-python@v7.1.0' + '.github/workflows/tests.yml': + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v8.0.2' + - 'actions/setup-python@v7.1.0' + - 'actions/upload-artifact@v7.0.2' + - 'astral-sh/setup-uv@v10.3.3' + - 'coverallsapp/github-action@v2.3.8' + - 'ncipollo/release-action@v1.21.0' + '.github/workflows/zizmor.yml': + - 'actions/checkout@v7.0.1' + - 'github/codeql-action@v4.39.3' +dependencies: + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/download-artifact@v8.0.2': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' + owner_id: 44036562 + repo_id: 192626254 + 'actions/setup-python@v7.1.0': + ref: 'v7.1.0' + commit: 'sha1-6d4fd22b20465ccc0f7354476588e8df7c9ca0e0' + owner_id: 44036562 + repo_id: 192625525 + 'actions/upload-artifact@v7.0.2': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' + owner_id: 44036562 + repo_id: 192625955 + 'astral-sh/setup-uv@v10.3.3': + ref: 'v10.3.3' + commit: 'sha1-68559e99cc807c1eb7e9238fd43a15bba460eec2' + owner_id: 115962839 + repo_id: 846733598 + 'coverallsapp/github-action@v2.3.8': + ref: 'v2.3.8' + commit: 'sha1-8d6379e14d29928660c4ba802d8e85393440b329' + owner_id: 16691566 + repo_id: 200696780 + 'github/codeql-action@v4.39.3': + ref: 'v4.39.3' + commit: 'sha1-33d7b85da1a04171e211befe2c739303b9a4c066' + owner_id: 9919 + repo_id: 259445878 + 'google/oss-fuzz@06a694ed8ee65428f29d220a001681a19ccde657': + ref: 'master' + commit: 'sha1-06a694ed8ee65428f29d220a001681a19ccde657' + owner_id: 1342004 + repo_id: 63809205 + 'matteogabriele/agentscan-action@v2.5.0': + ref: 'v2.5.0' + commit: 'sha1-8112fb79b33fafb8506159df20129a34209ac410' + owner_id: 5337152 + repo_id: 1183120486 + 'ncipollo/release-action@v1.21.0': + ref: 'v1.21.0' + commit: 'sha1-339a81892b84b4eeb0f6e744e4574d79d0d9b8dd' + owner_id: 5712756 + repo_id: 204020546 + 'peakoss/anti-slop@v0.3.0': + ref: 'v0.3.0' + commit: 'sha1-57858eead489d08b255fab2af45a506c2ca6eab2' + owner_id: 227272980 + repo_id: 1153153658 diff --git a/.github/workflows/agent-scan.yml b/.github/workflows/agent-scan.yml index de26d55eb..2266db936 100644 --- a/.github/workflows/agent-scan.yml +++ b/.github/workflows/agent-scan.yml @@ -30,7 +30,7 @@ jobs: # key: agentscan-cache-${{ github.actor }} # restore-keys: agentscan-cache- - name: AgentScan - uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410 # v2.5.0 + uses: MatteoGabriele/agentscan-action@v2.5.0 with: # allowed-users: "angatha,ennamarie19,niccokunzmann,peskypotato,SashankBhamidi,stevepiercy" honeypot: true diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 74df8c513..4e302d2c2 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -21,7 +21,7 @@ jobs: fuzz-seconds: 600 output-sarif: true - name: Upload Crash - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + uses: actions/upload-artifact@v7.0.2 if: failure() && steps.build.outcome == 'success' with: name: artifacts @@ -29,7 +29,7 @@ jobs: - name: Upload Sarif if: always() && steps.build.outcome == 'success' # https://github.com/github/codeql-action/releases - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 + uses: github/codeql-action/upload-sarif@v4.39.3 with: # Path to SARIF file relative to the root of the repository sarif_file: cifuzz-sarif/results.sarif diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index b94c1f456..96cd1ff87 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -28,13 +28,13 @@ jobs: matrix: python-version: ['3.11', '3.14'] steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 fetch-tags: true - name: Install uv - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + uses: astral-sh/setup-uv@v10.3.3 with: # UV_VERSION can be set in the repository settings: # Settings -> Secrets and variables -> Actions or click here: diff --git a/.github/workflows/pr-quality.yml b/.github/workflows/pr-quality.yml index 43c088514..893bd12c8 100644 --- a/.github/workflows/pr-quality.yml +++ b/.github/workflows/pr-quality.yml @@ -17,7 +17,7 @@ jobs: anti-slop: runs-on: ubuntu-latest steps: - - uses: peakoss/anti-slop@57858eead489d08b255fab2af45a506c2ca6eab2 # v0.3.0 + - uses: peakoss/anti-slop@v0.3.0 with: max-failures: 4 max-description-length: 1500 diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml index f2c775959..29bfca2f7 100644 --- a/.github/workflows/ruff.yml +++ b/.github/workflows/ruff.yml @@ -9,9 +9,9 @@ jobs: Please set up your development environment and run the formatting command. https://icalendar.readthedocs.io/en/stable/contribute/development.html#format-code steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Set up Python - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + uses: actions/setup-python@v7.1.0 with: python-version: 3.14 cache: pip diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 127c04803..8c093d948 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -21,7 +21,7 @@ jobs: # See https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/passing-information-between-jobs#example-defining-outputs-for-a-job include: ${{ steps.set-matrix.outputs.include }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Set matrix id: set-matrix env: @@ -44,13 +44,13 @@ jobs: - name: Skip notice if: ${{ matrix.skip }} run: echo "Skipped ${{ matrix.test_name }} (not required for this trigger)" - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 if: ${{ !matrix.skip }} with: fetch-tags: true - name: Install uv and Python ${{ matrix.python_version }} if: ${{ !matrix.skip }} - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + uses: astral-sh/setup-uv@v10.3.3 with: # zizmor: ignore[cache-poisoning] - run-tests does not produce release artifacts enable-cache: true @@ -70,7 +70,7 @@ jobs: run: ${{ matrix.test_command }} - name: Coveralls Parallel if: ${{ !matrix.skip }} - uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2 + uses: coverallsapp/github-action@v2.3.8 with: flag-name: run-${{ matrix.test_name }} parallel: true @@ -89,7 +89,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Coveralls Finished - uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2 + uses: coverallsapp/github-action@v2.3.8 with: parallel-finished: true format: cobertura @@ -101,18 +101,18 @@ jobs: contents: read runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Install uv and Python - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + uses: astral-sh/setup-uv@v10.3.3 with: enable-cache: false version: "0.11.6" - name: Check the release files run: make test-dist - name: Upload built packages - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: built-packages path: dist/* @@ -124,12 +124,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Download built packages - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: name: built-packages path: dist - name: Install uv and Python 3.14 - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + uses: astral-sh/setup-uv@v10.3.3 with: enable-cache: false # UV_VERSION can be set in the repository settings: @@ -165,9 +165,9 @@ jobs: TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }} TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Set up Python - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + uses: actions/setup-python@v7.1.0 with: python-version: "3.14" - name: Update pip @@ -206,9 +206,9 @@ jobs: environment: name: github-release steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Create GitHub release from tag - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 + uses: ncipollo/release-action@v1.21.0 with: allowUpdates: true body: "To view the changes, please see the [Changelog](https://icalendar.readthedocs.io/en/latest/reference/changelog.html). This release can be installed from [PyPI](https://pypi.org/project/icalendar/#history)." diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index da1c0459d..fba6159e4 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -16,17 +16,37 @@ jobs: security-events: write steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Update pip run: scripts/update-pip.sh - name: Install zizmor - run: pip install zizmor==1.30.1 # also update pyproject.toml + # 1.32.0 is the first release that reads the actions lockfile + run: pip install zizmor==1.32.0 # also update pyproject.toml - name: Run zizmor run: zizmor --format sarif .github/workflows/ > zizmor-results.sarif - name: Upload SARIF file # https://github.com/github/codeql-action/releases - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 + uses: github/codeql-action/upload-sarif@v4.39.3 with: sarif_file: zizmor-results.sarif + + # Fails when .github/workflows/actions.lock is out of sync with the + # workflows or a locked pin no longer verifies upstream. + # https://docs.github.com/en/actions/how-tos/administer/enforce-workflow-lockfiles + lockfile: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout repository + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - name: Verify the actions lockfile + env: + GH_TOKEN: ${{ github.token }} + run: | + gh extension install github/gh-actions-lock --pin v0.4.1 + gh actions-lock --verify diff --git a/news/2096.internal b/news/2096.internal new file mode 100644 index 000000000..bf7ceb25d --- /dev/null +++ b/news/2096.internal @@ -0,0 +1 @@ +Locked the GitHub Actions workflows: every workflow pins its actions by version tag, with the tag-to-commit mapping recorded in ``.github/workflows/actions.lock`` and verified in CI by ``gh actions-lock --verify`` (`Issue #2096 `_). @rahul05ranjan diff --git a/pyproject.toml b/pyproject.toml index a5de81739..61b6ecb8c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -103,7 +103,7 @@ dev = [ "towncrier>=25.8.0", "tox", "tox-uv", - "zizmor==1.30.1", # also update .github/workflows/zizmor.yml + "zizmor==1.32.0", # also update .github/workflows/zizmor.yml ] test = [ From d83d6d559832b55fef027df64d9ed81364d9b79d Mon Sep 17 00:00:00 2001 From: Rahul Ranjan Date: Fri, 13 Nov 2026 12:17:32 +0000 Subject: [PATCH 2/2] fix: restrict the zizmor dev dependency to Python >= 3.11 zizmor 1.32.0 (the first release that reads the actions lockfile) requires Python >= 3.11, while icalendar supports >= 3.10. uv therefore failed to resolve the dev group on the 3.10 leg of every job (venv creation aborted before any test ran). Mark the pin so it only applies where zizmor can install; the zizmor workflow itself still pip-installs 1.32.0 directly. Verified with `uv lock`: the dev and docs groups now resolve across the full requires-python range, with zizmor carrying the python_full_version >= '3.11' marker. Co-authored-by: rahul05ranjan <11793455+rahul05ranjan@users.noreply.github.com> --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 61b6ecb8c..56a633f65 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -103,7 +103,7 @@ dev = [ "towncrier>=25.8.0", "tox", "tox-uv", - "zizmor==1.32.0", # also update .github/workflows/zizmor.yml + "zizmor==1.32.0; python_version >= '3.11'", # also update .github/workflows/zizmor.yml ] test = [