You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
github_actions: pass home hostname to gh-actions-lock - #16504
Dependabot bumps uses: refs today without touching .github/workflows/actions.lock, so every repo using gh-actions-lock gets a PR with a stale lock. This relocks actions.lock alongside the bump using the gh-actions-lock CLI, and makes it work on GHE.com tenants where the home host is not github.com.
Home-host plumbing. The CLI binds every pin with an omitted lockfile hostname to its home host. Core runs it in a temp dir with no git remote, so without help it silently defaults to github.com.
CLI pin and schema gate. The Dockerfile installs the v0.2.0 release with sha256 checks. v0.0.2 and v0.0.3 are accepted, since the CLI migrates v0.0.2 and always writes v0.0.3. The gate only fires once the lock covers a workflow we're changing.
Exit-1 findings. Exit 1 means the CLI wrote nothing. The finding mapper turns an unresolvable finding (unreachable pin, repo replaced, and so on) into UnresolvableDependency, and anything else into a retryable EngineError. Host-identity 404s become DependencyFileNotResolvable. 5xx, rate-limit 403s and timeouts stay EngineError.
Schema-aware pin hosts. A pinned action binds to its lockfile host instead of probing the tenant, which falls back to github.com on any failure. pinned_hostname reads an omitted hostname as home in v0.0.3 and github.com in v0.0.2, ignores any other host, and matches owner/repo case-insensitively with an exact ref.
Anything you want to highlight for special attention from reviewers?
$/ support fetches every action definition in the repo, not just the ones workflows reference directly, because composites can call each other from anywhere. It's one recursive tree call plus a read per action file, and only when a workflow has a $/ reference. A truncated tree (over 100k entries) can miss composites, which surfaces as an EngineError rather than a wrong lock.
How will you know you've accomplished your goal?
Specs cover each boundary:
FileUpdater hands hostname: "tenant.ghe.com" to CliEngine, and the builder passes the tenant host through.
CliEngine always passes --hostname and materializes $/ actions under GH_ACTIONS_LOCK_REPO_ROOT. Exit-1 specs cover the finding mapper.
I have run the complete test suite to ensure all tests and linters pass.
I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
I have written clear and descriptive commit messages.
I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
I have ensured that the code is well-documented and easy to understand.
Builds github/gh-actions-lock#137 at c5ee15d from source; no release
exists for this SHA. Swap back to a release pin before review.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The engine binds every pin with an omitted lockfile hostname to its home
host. It runs in a temp dir with no git remote, so without --hostname
the home host silently defaults to github.com. Pass --hostname from the
job source and forward only a home-host token. Accept the v0.0.3 schema
the engine now writes, and report lock host-identity failures as
user-actionable rather than engine errors.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Fetch actions.lock for *.ghe.com sources under the existing
github_actions_lockfile experiment, same as github.com.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Error mapping (lockfile/cli_engine.rb:32): upstream, verifying repository identity also wraps transient errors such as 5xx, 429 and timeouts. Please make sure those don't surface to users as dependency_file_not_resolvable.
Deleted workflows (file_updater.rb:85): relocks are scoped to the changed workflows, so pins for removed workflows can stay in the lockfile. On Proxima, VerifyHosts checks every pin. Please confirm that a stale pin can't fail every relock.
Lockfile hostname (file_parser.rb:139-146): the parser resolves tenant-first and doesn't read the pin's hostname, while the CLI does. Please confirm this is OK for now, or track it as a follow-up.
Lockfile format: relocks write v0.0.3, which older CLI versions (v0.1.6) reject. Please make sure users have a compatible CLI before prod.
If we want to do dry-run for proxima
bin/dry-run.rb doesn't pass source_hostname, so Proxima dry-runs default to github.com.
CI: the nuget and pip-compile failures are unrelated.
gh-actions-lock wraps every RepoIDs error in 'verifying repository
identity', so 5xx, rate-limit 403s and timeouts were surfacing as
dependency_file_not_resolvable instead of retryable engine errors.
A pinned action now uses the host recorded in the lockfile (omitted
means the home host) instead of probing the tenant and falling back to
github.com on any failure.
`$/` composites can live anywhere in the repo and call each other, so the
engine needs every action.yml/action.yaml at its repo-relative path. Fetch
them with one recursive tree call when a workflow uses `$/` and the lock
exists, and name the temp dir as the repo root via GH_ACTIONS_LOCK_REPO_ROOT.
This reader is used for host binding without checking its schema version. Consequently, an unsupported future lockfile can redirect parsed dependencies using fields whose semantics this version explicitly does not understand, even when the updater never reaches its later VersionGate check. Ignore unsupported readers here (while leaving the updater responsible for raising when an affected workflow is relocked).
Preserve case-sensitive Git refs during lock entry matching
Git refs are case-sensitive, but casecmp? folds the entire owner/repo@ref key. If a lock contains refs that differ only by case (for example @Main and @main), this can select the other entry and bind the dependency to its hostname. Compare only the repository portion case-insensitively and keep the ref comparison exact.
This source-text regex misses valid flow-style and aliased YAML uses declarations, such as the already-supported steps: [{ uses: $/tools/setup }] form (see github_actions/spec/fixtures/workflow_files/workflow_multiline_flow_separate.yml). In those workflows no action definitions are fetched, so the CLI cannot inspect the self-repository action and relocking fails. Detect self-repository uses through WorkflowFile#uses_declarations (including resolved aliases) rather than a line-oriented regex.
Local action migrations are discarded from temporary files
The upgraded CLI migrates uses: ./… to $/… by default and writes those changes into the temporary workflows and composite action files, but this method only reads actions.lock back; all of those source-file edits are discarded. This can return a lock generated from content that is never committed. Disable local-action migration here unless FileUpdater also returns every mutated workflow/action file.
casecmp? also folds the ref, but Git refs are case-sensitive. The CLI canonicalizes only owner/repo while preserving ref case, so a lock entry such as owner/repo@Release can incorrectly supply its hostname for an unpinned owner/repo@release use (or select the wrong entry when both exist). Compare the NWO case-insensitively and the ref exactly.
This raw-line detector misses valid YAML forms such as steps: [{ uses: $/tools/setup }] and quoted keys ("uses": "$/tools/setup"). The parser already supports flow-style uses declarations (github_actions/spec/fixtures/workflow_files/workflow_multiple_actions_flow.yml:7), but here those workflows return no support files, so the CLI runs without the referenced action manifests and reports local-action. Detect self-repository uses from parsed declarations, or otherwise cover all valid YAML forms.
This raw line regex misses valid YAML forms already supported by WorkflowFile, including uses: >- block scalars, aliases, and flow-style mappings. A workflow using $/... in one of those forms will skip fetching its action manifests, so the relock subprocess cannot resolve the self-repository action. Detect self references from WorkflowFile#uses_declarations instead of the source text.
Avoid treating unsupported schema versions as legacy
Unsupported schemas are currently treated as legacy schemas here. For example, VersionGate rejects v0.0.4, but an omitted hostname in that same lockfile is interpreted as github.com during parsing, which can send dependency discovery to the wrong host before the updater reaches the version gate. Return nil for unsupported versions so the existing host probe is used instead.
…keys
Self-repository detection now uses the parsed uses declarations, so quoted
keys, aliases and block scalars are found. Non-string lockfile keys no longer
raise from pinned_hostname.
The self-repository action inputs are not tied to the rewritten files. This list uses original dependency_files, so an updated root composite is relocked using its pre-update content; if that composite is the only changed file, the earlier changed_repository_workflows.empty? return skips relocking altogether. A workflow named .github/workflows/action.yml is also added here and overwrites its rewritten copy because in_repo writes action files second. Overlay updated files by repo path, exclude workflow paths from this list, and let changed closure actions trigger relocking of affected onboarded workflows.
The reason will be displayed to describe this comment to others. Learn more.
LGTM
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are you trying to accomplish?
Dependabot bumps
uses:refs today without touching.github/workflows/actions.lock, so every repo using gh-actions-lock gets a PR with a stale lock. This relocksactions.lockalongside the bump using thegh-actions-lockCLI, and makes it work on GHE.com tenants where the home host is notgithub.com.Home-host plumbing. The CLI binds every pin with an omitted lockfile
hostnameto its home host. Core runs it in a temp dir with no git remote, so without help it silently defaults togithub.com.bin/dry-run.rbinto the FileUpdater, and the engine always passes--hostname.actions.lockis fetched forgithub.comand*.ghe.comsources under the existinggithub_actions_lockfileexperiment.$/self-repository actions. When a workflow usesuses: $/..., the fetcher pulls everyaction.yml/action.yamlin the repo and the engine writes them at repo-relative paths. The temp dir has no.git, so every relock setsGH_ACTIONS_LOCK_REPO_ROOTto name the root$/resolves against.CLI pin and schema gate. The Dockerfile installs the
v0.2.0release with sha256 checks.v0.0.2andv0.0.3are accepted, since the CLI migratesv0.0.2and always writesv0.0.3. The gate only fires once the lock covers a workflow we're changing.Exit-1 findings. Exit 1 means the CLI wrote nothing. The finding mapper turns an unresolvable finding (unreachable pin, repo replaced, and so on) into
UnresolvableDependency, and anything else into a retryableEngineError. Host-identity 404s becomeDependencyFileNotResolvable. 5xx, rate-limit 403s and timeouts stayEngineError.Schema-aware pin hosts. A pinned action binds to its lockfile host instead of probing the tenant, which falls back to
github.comon any failure.pinned_hostnamereads an omitted hostname as home inv0.0.3andgithub.cominv0.0.2, ignores any other host, and matches owner/repo case-insensitively with an exact ref.Anything you want to highlight for special attention from reviewers?
$/support fetches every action definition in the repo, not just the ones workflows reference directly, because composites can call each other from anywhere. It's one recursive tree call plus a read per action file, and only when a workflow has a$/reference. A truncated tree (over 100k entries) can miss composites, which surfaces as anEngineErrorrather than a wrong lock.How will you know you've accomplished your goal?
Specs cover each boundary:
hostname: "tenant.ghe.com"toCliEngine, and the builder passes the tenant host through.--hostnameand materializes$/actions underGH_ACTIONS_LOCK_REPO_ROOT. Exit-1 specs cover the finding mapper.github.com, legacyv0.0.2, foreign hosts and ref case.$/fetches andghe.comsources.Checklist