Skip to content

Lock GitHub Actions workflows - #161811

Open
hugovk wants to merge 4 commits into
python:mainfrom
hugovk:3.16-gha-lockfile
Open

Lock GitHub Actions workflows#161811
hugovk wants to merge 4 commits into
python:mainfrom
hugovk:3.16-gha-lockfile

Conversation

@hugovk

@hugovk hugovk commented Nov 11, 2026

Copy link
Copy Markdown
Member

GitHub Actions now supports lockfiles for workflows.

See https://hugovk.dev/blog/2026/lock-github-actions/

Also update zizmor in prek to support lockfiles (I also updated the other hooks, they don't trigger any code changes).

It has a new finding about new $/ self-repository syntax, let's fix it:

  help[self-repository]: use GitHub's dedicated self-repository syntax
     --> .github/workflows/reusable-docs.yml:107:11
      |
  104 |     name: 'Check for removed HTML IDs'
      |     ---------------------------------- this job
  ...
  107 |     uses: ./.github/workflows/reusable-check-html-ids.yml
      |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
      |
      = note: audit confidence → High
      = note: this finding has an auto-fix

However, http://github.com/rhysd/actionlint doesn't yet support the $/ syntax (rhysd/actionlint#711), so ignore that in actionlint.

We're already ignoring it's lack of support for ubuntu-26.04* runners (rhysd/actionlint#682).

There are pending PRs, but the tool author isn't active, so we could consider this fork:
rhysd/actionlint#719 (comment). Perhaps when we need to add a third ignore...

Finally, zizmor also flags this:

  help[adhoc-packages]: ad-hoc installation of packages
    --> .github/workflows/new-bugs-announce-notifier.yml:21:14
     |
  21 |       - run: npm install mailgun.js form-data
     |         ---  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ installs a package outside of a lockfile
     |         |
     |         this step
     |
     = note: audit confidence → High

I added a temporary zizmor ignore on that, let's tackle that in a follow up with an npm lockfile or a Python stdlib version.

@hugovk
hugovk requested review from a team, DinoV, Yhg1s, hoodmane and pablogsal as code owners November 11, 2026 16:30
@hugovk hugovk added the infra CI, GitHub Actions, buildbots, Dependabot, etc. label Nov 11, 2026
This was referenced Nov 12, 2026
Open
Closed
@geekjourneyx geekjourneyx mentioned this pull request Nov 12, 2026
Open
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ezio-melotti ezio-melotti ezio-melotti approved these changes
@StanFromIreland StanFromIreland StanFromIreland approved these changes
@Yhg1s Yhg1s Awaiting requested review from Yhg1s Yhg1s is a code owner
@DinoV DinoV Awaiting requested review from DinoV DinoV is a code owner
@pablogsal pablogsal Awaiting requested review from pablogsal pablogsal is a code owner
@hoodmane hoodmane Awaiting requested review from hoodmane hoodmane is a code owner
@JacobCoffee JacobCoffee Awaiting requested review from JacobCoffee JacobCoffee is a code owner
@AA-Turner AA-Turner Awaiting requested review from AA-Turner AA-Turner is a code owner
@webknjaz webknjaz Awaiting requested review from webknjaz webknjaz is a code owner
@itamaro itamaro Awaiting requested review from itamaro itamaro is a code owner

Assignees

No one assigned

Labels

awaiting merge infra CI, GitHub Actions, buildbots, Dependabot, etc. skip issue skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@hugovk @ezio-melotti @StanFromIreland