Skip to content

Add lockfile to pin all gha dependencies #855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lpmi-13 wants to merge 1 commit into
base: develop
Choose a base branch
from
+77 −18
Open

Add lockfile to pin all gha dependencies #855

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/setup-sdk-environment/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ inputs:
runs:
using: composite
steps:
- uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
- uses: astral-sh/setup-uv@v8.0.0
with:
version: 0.11.6
python-version: 3.13
Expand Down
59 changes: 59 additions & 0 deletions .github/workflows/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
# This file is machine-generated by `gh actions-lock`.
# Do not edit by hand; run `gh actions-lock` to update.
# Docs: https://gh.io/actions-lockfile
version: 'v0.0.3'
workflows:
'.github/workflows/appinspect.yml':
- 'actions/checkout@v7.0.1'
- 'astral-sh/setup-uv@v8.0.0'
'.github/workflows/cd.yml':
- 'actions/checkout@v7.0.1'
- 'actions/download-artifact@v8.0.1'
- 'actions/upload-artifact@v7.0.1'
- 'astral-sh/setup-uv@v8.0.0'
- 'pypa/gh-action-pypi-publish@v1.14.1'
'.github/workflows/lint.yml':
- 'actions/checkout@v7.0.1'
- 'astral-sh/setup-uv@v8.0.0'
'.github/workflows/test.yml':
- 'actions/cache@v6.1.0'
- 'actions/checkout@v7.0.1'
- 'astral-sh/setup-uv@v8.0.0'
dependencies:
'actions/cache@v6.1.0':
ref: 'v6.1.0'
commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
owner_id: 44036562
repo_id: 215566462
'actions/checkout@v7.0.1':
ref: 'v7.0.1'
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
'actions/download-artifact@v8.0.1':
ref: 'v8.0.1'
commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
owner_id: 44036562
repo_id: 192626254
'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405':
ref: 'v6.2.0'
commit: 'sha1-a309ff8b426b58ec0e2a45f0f869d46889d02405'
owner_id: 44036562
repo_id: 192625525
'actions/upload-artifact@v7.0.1':
ref: 'v7.0.1'
commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
owner_id: 44036562
repo_id: 192625955
'astral-sh/setup-uv@v8.0.0':
ref: 'v8.0.0'
commit: 'sha1-cec208311dfd045dd5311c1add060b2062131d57'
owner_id: 115962839
repo_id: 846733598
'pypa/gh-action-pypi-publish@v1.14.1':
ref: 'v1.14.1'
commit: 'sha1-ba38be9e461d3875417946c167d0b5f3d385a247'
owner_id: 647025
repo_id: 178055147
uses:
- 'actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405'
6 changes: 3 additions & 3 deletions .github/workflows/appinspect.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,12 @@ jobs:
name: Run AppInspect
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: ./.github/actions/setup-sdk-environment
- uses: $/.github/actions/setup-sdk-environment

@lpmi-13 lpmi-13 Nov 12, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is to documented way to refer to local actions:
https://github.com/github/gh-actions-lock#limitations

@Ickerday Ickerday Nov 12, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah found out about this recently when running zizmor on some of our repos. The syntax does indeed work, but clankers desperately flag this as wrong despite noting down otherwise in AGENTS.md. We don't use LLMs here much, but non-maintainers will definitely bring this up thinking it's a mistake. Alas, we might need to leave this in for now just to spare ourselves the unnecessary busywork. :(

with:
deps-group: lint
- name: Run AppInspect
uses: ./.github/actions/run-appinspect
uses: $/.github/actions/run-appinspect
continue-on-error: ${{ github.event_name == 'pull_request' }}
18 changes: 9 additions & 9 deletions .github/workflows/cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,10 @@ jobs:
outputs:
version: ${{ steps.get-version.outputs.version }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: ./.github/actions/setup-sdk-environment
- uses: $/.github/actions/setup-sdk-environment
with:
deps-group: release
- name: Set pre-release version
Expand Down Expand Up @@ -52,16 +52,16 @@ jobs:
run: uv build
- name: Run AppInspect
if: startsWith(github.ref, 'refs/tags/') == true
uses: ./.github/actions/run-appinspect
uses: $/.github/actions/run-appinspect
- name: Upload distributables
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
uses: actions/upload-artifact@v7.0.1
with:
name: splunk-sdk-${{ steps.get-version.outputs.version }}
path: dist/
- name: Generate API reference
run: make docs-zip
- name: Upload docs artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
uses: actions/upload-artifact@v7.0.1
with:
name: python-sdk-docs
path: docs/_build/splunk-sdk-python-docs.zip
Expand All @@ -78,12 +78,12 @@ jobs:
url: https://test.pypi.org/project/splunk-sdk/
steps:
- name: Download distributables
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
uses: actions/download-artifact@v8.0.1
with:
name: splunk-sdk-${{ needs.build-distributables.outputs.version }}
path: dist/
- name: Publish packages to Test PyPI
uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247
uses: pypa/gh-action-pypi-publish@v1.14.1
with:
repository-url: https://test.pypi.org/legacy/

Expand All @@ -99,11 +99,11 @@ jobs:
url: https://pypi.org/project/splunk-sdk/
steps:
- name: Download distributables
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
uses: actions/download-artifact@v8.0.1
with:
name: splunk-sdk-${{ needs.build-distributables.outputs.version }}
path: dist/
- name: Publish packages to PyPI
uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247
uses: pypa/gh-action-pypi-publish@v1.14.1
with:
repository-url: https://upload.pypi.org/legacy/
4 changes: 2 additions & 2 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,10 @@ jobs:
name: Run linters
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: ./.github/actions/setup-sdk-environment
- uses: $/.github/actions/setup-sdk-environment
with:
deps-group: lint
- name: Verify uv.lock is up-to-date
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,10 @@ jobs:
matrix:
splunk-version: [latest]
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: actions/checkout@v7.0.1
with:
persist-credentials: false
- uses: ./.github/actions/setup-sdk-environment
- uses: $/.github/actions/setup-sdk-environment
with:
deps-group: test
- name: Download Splunk MCP Server App
Expand Down Expand Up @@ -52,7 +52,7 @@ jobs:
echo "internal_ai_base_url=$INTERNAL_AI_BASE_URL" >> .env
- name: Restore pytest cache
if: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/develop' }}
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
uses: actions/cache@v6.1.0
with:
path: .pytest_cache
key: pytest-cache-${{ runner.os }}-${{ github.ref_name }}-${{ github.sha }}
Expand Down