github_actions: pass home hostname to gh-actions-lock by nodeselector · Pull Request #16504 · dependabot/dependabot-core

nodeselector · 2026-10-08T20:43:57Z

What are you trying to accomplish?

Pass the repository's home host to gh-actions-lock so lockfile relocks stay correct with the hostname-aware CLI (github/gh-actions-lock#137).

The CLI binds every pin with an omitted lockfile hostname to its home host. Core runs it in a temp dir with no git remote, so the home host silently defaults to github.com.

Always pass --hostname, taken from the job source.
Forward only a home-host token. Other hosts are read anonymously.
Accept v0.0.3. The CLI migrates v0.0.2 and always writes v0.0.3.
Report host-identity failures as user errors, not engine errors.
Fetch and relock actions.lock for *.ghe.com sources under the existing github_actions_lockfile experiment, same as github.com. dependabot-api already sends it from the repo flag dependabot_github_actions_lockfile, so no API change is needed.

Anything you want to highlight for special attention from reviewers?

Draft for staging only. The Dockerfile temporarily builds the CLI from source at c5ee15d, because no release exists for that SHA yet. It moves back to a release pin before review.

How will you know you've accomplished your goal?

Staging dry-runs against existing lockfiles. Relocks should keep the right host binding and write v0.0.3.

A FileUpdater spec checks that source_hostname: "tenant.ghe.com" reaches CliEngine.new(credentials, hostname: "tenant.ghe.com").

Checklist

I have run the complete test suite to ensure all tests and linters pass.
I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
I have written clear and descriptive commit messages.
I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
I have ensured that the code is well-documented and easy to understand.

Copilot

🟡 Changes recommended

The dry-run path still defaults tenant relocks to github.com, and the staging-only source build must be replaced before merging.

3 open findings

Restore released binary and checksum verification before merging · New
Pass source hostname to updater to support custom GitHub hosts · New
Test that custom source hostname reaches updater options · New

What changed in this PR

Adds hostname-aware GitHub Actions lockfile relocking, including *.ghe.com support and schema v0.0.3 compatibility.

Changes:

Propagates the repository hostname and selects only its credential.
Enables experimental *.ghe.com lockfile handling and maps host errors.
Temporarily builds the hostname-aware CLI from source.

File	Description
`updater/spec/dependabot/dependency_change_builder_spec.rb`	Tests hostname option propagation.
`updater/lib/dependabot/dependency_change_builder.rb`	Passes the source hostname to file updaters.
`github_actions/spec/dependabot/github_actions/lockfile/version_gate_spec.rb`	Covers schema v0.0.3.
`github_actions/spec/dependabot/github_actions/lockfile/env_spec.rb`	Tests tenant credential selection.
`github_actions/spec/dependabot/github_actions/lockfile/cli_engine_spec.rb`	Tests hostname arguments and identity errors.
`github_actions/spec/dependabot/github_actions/file_fetcher_spec.rb`	Covers experimental `ghe.com` fetching.
`github_actions/lib/dependabot/github_actions/lockfile/version_gate.rb`	Supports multiple schema versions.
`github_actions/lib/dependabot/github_actions/lockfile/errors.rb`	Updates supported-version messaging.
`github_actions/lib/dependabot/github_actions/lockfile/env.rb`	Selects credentials for the home host.
`github_actions/lib/dependabot/github_actions/lockfile/cli_engine.rb`	Supplies hostname and maps identity failures.
`github_actions/lib/dependabot/github_actions/file_updater.rb`	Forwards hostname during relocking.
`github_actions/lib/dependabot/github_actions/file_fetcher.rb`	Gates `*.ghe.com` lockfiles experimentally.
`github_actions/lib/dependabot/github_actions/constants.rb`	Adds schema v0.0.3 support.
`github_actions/Dockerfile`	Builds the unreleased CLI revision from source.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Builds github/gh-actions-lock#137 at c5ee15d from source; no release exists for this SHA. Swap back to a release pin before review. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

The Dockerfile still contains the explicitly temporary source build that must return to a checksummed release pin before merge.

1 open finding

Restore released binary and checksum verification before merging

2 resolved since last review

Pass source hostname to updater to support custom GitHub hosts
Test that custom source hostname reaches updater options

🧠 Review effort: Balanced

Copilot

🟡 Changes recommended

The FileUpdater hostname handoff lacks direct regression coverage, and the Dockerfile remains staging-only.

1 open finding

Add regression coverage for FileUpdater-to-CLI hostname handoff · New

1 resolved since last review

Restore released binary and checksum verification before merging

🧠 Review effort: Balanced

        # Materialize the full onboarded closure so the lock remains intact, but fix
        # only changed workflows so unrelated refs are not touched.
-        content = Lockfile::CliEngine.new(credentials).relock(
+        content = Lockfile::CliEngine.new(credentials, hostname: source_hostname).relock(


The engine binds every pin with an omitted lockfile hostname to its home host. It runs in a temp dir with no git remote, so without --hostname the home host silently defaults to github.com. Pass --hostname from the job source and forward only a home-host token. Accept the v0.0.3 schema the engine now writes, and report lock host-identity failures as user-actionable rather than engine errors. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Fetch actions.lock for *.ghe.com sources under the existing github_actions_lockfile experiment, same as github.com. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

The Dockerfile still contains the explicitly temporary source build that must return to a checksummed release pin before merging.

1 open finding

Add regression coverage for FileUpdater-to-CLI hostname handoff

🧠 Review effort: Balanced

Copilot AI balanced review requested due to automatic review settings October 8, 2026 20:43

github-actions Bot added the L: github:actions GitHub Actions label Oct 8, 2026

Copilot started reviewing on behalf of nodeselector October 8, 2026 20:44 View session

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Comment thread github_actions/Dockerfile Outdated

Comment thread github_actions/lib/dependabot/github_actions/file_updater.rb

Comment thread updater/spec/dependabot/dependency_change_builder_spec.rb

github_actions: TEMP build gh-actions-lock c5ee15d for staging

4afde00

Builds github/gh-actions-lock#137 at c5ee15d from source; no release exists for this SHA. Swap back to a release pin before review. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings October 8, 2026 21:41

nodeselector force-pushed the nodeselector/gh-actions-lock-hostname branch from 743c5f2 to 8d124a5 Compare October 8, 2026 21:41

Copilot started reviewing on behalf of nodeselector October 8, 2026 21:42 View session

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 8, 2026 21:50

nodeselector force-pushed the nodeselector/gh-actions-lock-hostname branch from 8d124a5 to 9050ba9 Compare October 8, 2026 21:50

Copilot started reviewing on behalf of nodeselector October 8, 2026 21:51 View session

nodeselector marked this pull request as ready for review October 8, 2026 21:53

nodeselector requested a review from a team as a code owner October 8, 2026 21:53

Copilot AI reviewed Oct 8, 2026

View reviewed changes

nodeselector and others added 2 commits October 8, 2026 15:02

github_actions: allow ghe.com lockfiles

9b6de3b

Fetch actions.lock for *.ghe.com sources under the existing github_actions_lockfile experiment, same as github.com. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings October 8, 2026 22:07

nodeselector force-pushed the nodeselector/gh-actions-lock-hostname branch from 9050ba9 to 9b6de3b Compare October 8, 2026 22:07

Copilot started reviewing on behalf of nodeselector October 8, 2026 22:08 View session

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Navigation Menu

Repository navigation

github_actions: pass home hostname to gh-actions-lock - #16504

github_actions: pass home hostname to gh-actions-lock#16504
nodeselector wants to merge 3 commits into
dependabot:mainfrom
nodeselector:nodeselector/gh-actions-lock-hostname

nodeselector commented Oct 8, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nodeselector commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What are you trying to accomplish?

Anything you want to highlight for special attention from reviewers?

How will you know you've accomplished your goal?

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nodeselector commented Oct 8, 2026 •

edited

Loading