From 1353a923d890e2c8d25bf69920762110285c6e4e Mon Sep 17 00:00:00 2001 From: MohamedBassem Date: Wed, 28 Oct 2026 14:54:12 +0000 Subject: [PATCH] Lock GitHub Actions dependencies with a workflow lockfile Co-Authored-By: Claude Opus 5.5 --- .github/workflows/actions.lock | 186 ++++++++++++++++++++++++++ .github/workflows/ci.yaml | 6 +- .github/workflows/docker.yaml | 12 +- .github/workflows/integration.yaml | 14 +- .github/workflows/release.yml | 20 +-- .github/workflows/verify-lockfile.yml | 25 ++++ 6 files changed, 237 insertions(+), 26 deletions(-) create mode 100644 .github/workflows/actions.lock create mode 100644 .github/workflows/verify-lockfile.yml diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..a0d94ae --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,186 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/ci.yaml': + - 'actions/checkout@v4.4.0' + - 'dtolnay/rust-toolchain@stable' + - 'ruby/setup-ruby@v1.335.0' + - 'swatinem/rust-cache@v2.9.3' + '.github/workflows/docker.yaml': + - 'actions/checkout@v4.4.0' + - 'docker/build-push-action@v3.3.1' + - 'docker/login-action@v2.2.0' + - 'docker/metadata-action@v5.10.0' + - 'docker/setup-buildx-action@v2.10.0' + - 'docker/setup-qemu-action@v2.2.0' + '.github/workflows/integration.yaml': + - 'actions/checkout@v4.4.0' + - 'actions/download-artifact@v4.3.0' + - 'dawidd6/action-download-artifact@v3.1.4' + - 'docker/build-push-action@v6.19.2' + - 'docker/setup-buildx-action@v3.12.0' + - 'docker/setup-docker-action@v4.7.0' + - 'docker/setup-qemu-action@v3.7.0' + - 'restatedev/e2e@v2.2' + '.github/workflows/release.yml': + - 'actions/checkout@v4.4.0' + - 'actions/download-artifact@v4.3.0' + - 'actions/upload-artifact@v4.6.2' + - 'oxidize-rb/actions@v1.5.0' + - 'ruby/setup-ruby@v1.335.0' + - 'rubygems/configure-rubygems-credentials@v1.0.0' + '.github/workflows/verify-lockfile.yml': + - 'actions/checkout@v7.0.1' +dependencies: + 'actions/cache@v5': + ref: 'v5' + commit: 'sha1-caa296126883cff596d87d8935842f9db880ef25' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/download-artifact@v4.3.0': + ref: 'v4.3.0' + commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093' + owner_id: 44036562 + repo_id: 192626254 + 'actions/github-script@v8': + ref: 'v8' + commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd' + owner_id: 44036562 + repo_id: 205262760 + 'actions/setup-java@v4': + ref: 'v4' + commit: 'sha1-cf277c60eb25467037889841efdb72551f06f6c3' + owner_id: 44036562 + repo_id: 196057608 + 'actions/upload-artifact@v4': + ref: 'v4' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v4.6.2': + ref: 'v4.6.2' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'dawidd6/action-download-artifact@v3.1.4': + ref: 'v3.1.4' + commit: 'sha1-09f2f74827fd3a8607589e5ad7f9398816f540fe' + owner_id: 9713907 + repo_id: 239218448 + 'docker/build-push-action@v3.3.1': + ref: 'v3.3.1' + commit: 'sha1-1104d471370f9806843c095c1db02b5a90c5f8b6' + owner_id: 5429470 + repo_id: 241092383 + 'docker/build-push-action@v6.19.2': + ref: 'v6.19.2' + commit: 'sha1-10e90e3645eae34f1e60eeb005ba3a3d33f178e8' + owner_id: 5429470 + repo_id: 241092383 + 'docker/login-action@v2.2.0': + ref: 'v2.2.0' + commit: 'sha1-465a07811f14bebb1938fbed4728c6a1ff8901fc' + owner_id: 5429470 + repo_id: 287743349 + 'docker/metadata-action@v5.10.0': + ref: 'v5.10.0' + commit: 'sha1-c299e40c65443455700f0fdfc63efafe5b349051' + owner_id: 5429470 + repo_id: 306769011 + 'docker/setup-buildx-action@v2.10.0': + ref: 'v2.10.0' + commit: 'sha1-885d1462b80bc1c1c7f0b00334ad271f09369c55' + owner_id: 5429470 + repo_id: 288485773 + 'docker/setup-buildx-action@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-8d2750c68a42422c14e847fe6c8ac0403b4cbd6f' + owner_id: 5429470 + repo_id: 288485773 + 'docker/setup-docker-action@v4.7.0': + ref: 'v4.7.0' + commit: 'sha1-e43656e248c0bd0647d3f5c195d116aacf6fcaf4' + owner_id: 5429470 + repo_id: 398780917 + 'docker/setup-qemu-action@v2.2.0': + ref: 'v2.2.0' + commit: 'sha1-2b82ce82d56a2a04d2637cd93a637ae1b359c0a7' + owner_id: 5429470 + repo_id: 288487894 + 'docker/setup-qemu-action@v3.7.0': + ref: 'v3.7.0' + commit: 'sha1-c7c53464625b32c7a7e944ae62b3e17d2b600130' + owner_id: 5429470 + repo_id: 288487894 + 'dtolnay/rust-toolchain@master': + ref: 'master' + commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8' + owner_id: 1940490 + repo_id: 260749683 + 'dtolnay/rust-toolchain@stable': + ref: 'stable' + commit: 'sha1-b725eda525362e7cf34af9a7243cac1e3f01a7ec' + owner_id: 1940490 + repo_id: 260749683 + 'enricomi/publish-unit-test-result-action@v2': + ref: 'v2' + commit: 'sha1-7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d' + owner_id: 44700269 + repo_id: 290227969 + 'oxidize-rb/actions@v1': + ref: 'v1' + commit: 'sha1-ec90b4aa48795518d79be3f5cc478d1d7ccd02a8' + owner_id: 103265923 + repo_id: 539672782 + 'oxidize-rb/actions@v1.5.0': + ref: 'v1.5.0' + commit: 'sha1-ec90b4aa48795518d79be3f5cc478d1d7ccd02a8' + owner_id: 103265923 + repo_id: 539672782 + uses: + - 'actions/cache@v5' + - 'actions/github-script@v8' + - 'dtolnay/rust-toolchain@master' + - 'oxidize-rb/actions@v1' + - 'ruby/setup-ruby-pkgs@v1' + 'restatedev/e2e@v2.2': + ref: 'v2.2' + commit: 'sha1-edd926b59e51af418b95c143220c0a2a62b7fd7b' + owner_id: 97341811 + repo_id: 489007488 + uses: + - 'actions/setup-java@v4' + - 'actions/upload-artifact@v4' + - 'enricomi/publish-unit-test-result-action@v2' + 'ruby/setup-ruby-pkgs@v1': + ref: 'v1' + commit: 'sha1-2233d39c1315c667a2970436418b520a6300124e' + owner_id: 210414 + repo_id: 243428768 + 'ruby/setup-ruby@v1.335.0': + ref: 'v1.335.0' + commit: 'sha1-7f797815d8adceb1c412e7abefdd1ab4abc47a5f' + owner_id: 210414 + repo_id: 231208785 + 'rubygems/configure-rubygems-credentials@v1.0.0': + ref: 'v1.0.0' + commit: 'sha1-bc6dd217f8a4f919d6835fcfefd470ef821f5c44' + owner_id: 208761 + repo_id: 631633510 + 'swatinem/rust-cache@v2.9.3': + ref: 'v2.9.3' + commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0' + owner_id: 580492 + repo_id: 298565987 diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3e1d7a8..108101b 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -12,10 +12,10 @@ jobs: name: Build, lint, typecheck & test steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Set up Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@v1.335.0 with: ruby-version: "3.3" bundler-cache: true @@ -24,7 +24,7 @@ jobs: uses: dtolnay/rust-toolchain@stable - name: Rust cache - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@v2.9.3 with: workspaces: ext/restate_internal diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml index 0aac089..877c2d2 100644 --- a/.github/workflows/docker.yaml +++ b/.github/workflows/docker.yaml @@ -18,16 +18,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 - name: Set up QEMU dependency - uses: docker/setup-qemu-action@v2 + uses: docker/setup-qemu-action@v2.2.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@v2.10.0 - name: Log into GitHub container registry - uses: docker/login-action@v2 + uses: docker/login-action@v2.2.0 with: registry: ${{ env.GHCR_REGISTRY }} username: ${{ env.GHCR_REGISTRY_USERNAME }} @@ -35,7 +35,7 @@ jobs: - name: Extract metadata (tags, labels) id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v5.10.0 with: images: | ghcr.io/restatedev/test-services-ruby @@ -45,7 +45,7 @@ jobs: type=semver,pattern={{major}}.{{minor}} - name: Build docker image - uses: docker/build-push-action@v3 + uses: docker/build-push-action@v3.3.1 with: context: . file: test-services/Dockerfile diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml index 1a1a9e9..07f6244 100644 --- a/.github/workflows/integration.yaml +++ b/.github/workflows/integration.yaml @@ -55,12 +55,12 @@ jobs: actions: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: repository: restatedev/sdk-ruby - name: Set up Docker containerd snapshotter - uses: docker/setup-docker-action@v4 + uses: docker/setup-docker-action@v4.7.0 with: version: "v28.5.2" set-host: true @@ -77,13 +77,13 @@ jobs: # We must use download-artifact to get artifacts created during *this* workflow run, ie by workflow call - name: Download restate snapshot from in-progress workflow if: ${{ inputs.restateCommit != '' && github.event_name != 'workflow_dispatch' }} - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v4.3.0 with: name: restate.tar # In the workflow dispatch case where the artifact was created in a previous run, we can download as normal - name: Download restate snapshot from completed workflow if: ${{ inputs.restateCommit != '' && github.event_name == 'workflow_dispatch' }} - uses: dawidd6/action-download-artifact@v3 + uses: dawidd6/action-download-artifact@v3.1.4 with: repo: restatedev/restate workflow: ci.yml @@ -99,14 +99,14 @@ jobs: # Either build the docker image from source - name: Set up QEMU if: ${{ inputs.serviceImage == '' }} - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v3.7.0 - name: Set up Docker Buildx if: ${{ inputs.serviceImage == '' }} - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v3.12.0 - name: Build Ruby test-services image if: ${{ inputs.serviceImage == '' }} id: build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v6.19.2 with: context: . file: "test-services/Dockerfile" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 49519aa..8450a15 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,7 +13,7 @@ jobs: version-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Verify version matches tag if: github.ref_type == 'tag' run: | @@ -36,7 +36,7 @@ jobs: result: ${{ steps.fetch.outputs.result }} steps: - id: fetch - uses: oxidize-rb/actions/fetch-ci-data@v1 + uses: oxidize-rb/actions/fetch-ci-data@v1.5.0 with: supported-ruby-platforms: | exclude: @@ -54,9 +54,9 @@ jobs: matrix: ruby-platform: ${{ fromJSON(needs.ci-data.outputs.result).supported-ruby-platforms }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - - uses: oxidize-rb/actions/setup-ruby-and-rust@v1 + - uses: oxidize-rb/actions/setup-ruby-and-rust@v1.5.0 with: ruby-version: "3.3" bundler-cache: true @@ -67,7 +67,7 @@ jobs: run: bundle exec rb-sys-dock --platform ${{ matrix.ruby-platform }} --ruby-versions "${{ join(fromJSON(needs.ci-data.outputs.result).stable-ruby-versions, ',') }}" --mount-toolchains --build - name: Upload gem - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: gem-${{ matrix.ruby-platform }} path: pkg/*-${{ matrix.ruby-platform }}.gem @@ -77,9 +77,9 @@ jobs: runs-on: ubuntu-latest needs: [version-check] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@v1.335.0 with: ruby-version: "3.3" @@ -87,7 +87,7 @@ jobs: run: gem build restate-sdk.gemspec - name: Upload gem - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: gem-source path: "*.gem" @@ -103,7 +103,7 @@ jobs: contents: read id-token: write steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v4.3.0 with: pattern: gem-* merge-multiple: true @@ -112,7 +112,7 @@ jobs: - name: List gems run: ls -la gems/ - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@v1.335.0 with: ruby-version: "3.3" diff --git a/.github/workflows/verify-lockfile.yml b/.github/workflows/verify-lockfile.yml new file mode 100644 index 0000000..a4e433b --- /dev/null +++ b/.github/workflows/verify-lockfile.yml @@ -0,0 +1,25 @@ +# Fails when .github/workflows/actions.lock is out of sync with the +# workflows or a locked pin no longer verifies upstream. + +name: verify-lockfile + +on: + pull_request: + push: + branches: + - main + +permissions: + contents: read + +jobs: + verify: + runs-on: ubuntu-latest + env: + GH_TOKEN: ${{ github.token }} + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - run: gh extension install github/gh-actions-lock --pin v0.4.0 + - run: gh actions-lock --verify