Is this verify_action_build data correct?

[hen]

Looking at https://github.com/apache/infrastructure-actions/actions/runs/25438354843/job/74622364343 it says in the table at the bottom that 1.7.0 of the action and 1.7.1 of the action were approved today by dependabot. No links to PRs.

I don't see any PRs for those. I do see a 1.7.0 approval on #225 but that's a year earlier.

Is this table a work in progress? new bug?

[potiuk]

I run analyze #813 in my agent (analyze skil coming from #807 and my agent came with the diagnosis (revieed looked plausible)

It also produced this:

• Fix PR: verify-action-build: skip lock-file check for empty package.json #816 (reviewers: dave2wave, raboof, dfoulks1)
• Comment on action-allowlist-review: bump browser-actions/setup-firefox from 1.7.1 to 1.7.2 in /.github/actions/for-dependabot-triggered-reviews #813: action-allowlist-review: bump browser-actions/setup-firefox from 1.7.1 to 1.7.2 in /.github/actions/for-dependabot-triggered-reviews #813 (comment)

There is a good reason for the diff showing this way and fixed verify script from #816 should handle the action diff better.

I propose we close this one, wait until #816 gets merged, ask dependabot to re-run it and look at the verify-actions output again.

Diagnosis (case E — verify-script gap):

PR #813 bumps browser-actions/setup-firefox@v1.7.2. The verify run fails on lock file presence — package.json has no matching lock file. JS build verification passes; binary downloads have verification; the only blocker is the lock-file check.

Looking at the tag tree (0bc507dd…):

• Files: README.md, action.yml, index.js, package.json — no src/, no dist/, no node_modules/, no lock file.
• package.json is just {"type": "module"} — declares zero dependencies.
• Source + lock file (pnpm-lock.yaml) live on master; the tag is a release-please-style bundled tag.

So this package.json carries no dependencies at all. The lock-file check exists to ensure transitive deps are pinned for reproducibility — but if there are no declared deps, there's nothing to pin and the check is moot.

analyze_lock_files already handles this exact case for pyproject.toml and go.mod:

pyproject.toml is often a bare config file ... Skip if no deps section.

if manifest == "pyproject.toml":
has_deps = bool(re.search(...))
if not has_deps: ...continue

go.mod without any require directives has no third-party deps...

if manifest == "go.mod":
has_require = bool(re.search(...))
if not has_require: ...continue

…but not for package.json. This is exactly the gap that's causing the false fail here. (Prior versions v1.7.0 / v1.7.1 were approved manually before the lock-file check landed in PR #770 on 2026-04-25; once the check existed, this whole class of bundled-action releases started bouncing.)

Proposed fix:

In utils/verify_action_build/security.py's analyze_lock_files, add a package.json no-deps skip mirroring the existing pyproject/go.mod ones:

if manifest == "package.json":
try:
pkg = json.loads(mcontent)
except json.JSONDecodeError:
pkg = {}
has_deps = any(
pkg.get(k) for k in (
"dependencies", "devDependencies",
"peerDependencies", "optionalDependencies",
)
)
if not has_deps:
_show_header()
console.print(
f" [dim]⊘[/dim] {ecosystem}: {mpath} declares no dependencies"
)
continue

Plus regression tests covering: empty package.json ({}), {"type": "module"} without deps (the setup-firefox shape), package.json with dependencies but no lock file (still fails), and package.json with devDependencies only and no lock file (still fails).

Plan:

1. New branch verify-action-build-skip-empty-package-json-lock off latest origin/main.
2. Fix in security.py + 4 tests in test_security.py's lock-file class.
3. prek run --all-files, uv run pytest utils/tests/.
4. Re-verify PR action-allowlist-review: bump browser-actions/setup-firefox from 1.7.1 to 1.7.2 in /.github/actions/for-dependabot-triggered-reviews #813 to confirm it passes.
5. Open fix PR (reviewers per memory: dave2wave, raboof, dfoulks1).
6. Comment on PR action-allowlist-review: bump browser-actions/setup-firefox from 1.7.1 to 1.7.2 in /.github/actions/for-dependabot-triggered-reviews #813 explaining the diagnosis + linking the fix.

OK to proceed? Or want it scoped differently (e.g. add browser-actions/setup-firefox to lock_file_exemptions.yml instead — quicker but less general)?