chore(github-actions): pin reqstool/.github references to 1.0.0 - #189
Merged
Conversation
Replaces a mix of @main and @<sha> # main <date> with a single shape: @<sha> # 1.0.0, against reqstool/.github's first tag. @main is mutable, so CodeQL's actions/unpinned-tag flags it and any change to the shared workflows reaches this repo with no review -- which bit twice this week while the PyPI publish path was being fixed. A bare tag would still be mutable; the sha-with-version-comment form satisfies the pinning audits while letting Renovate track the digest and rewrite the comment, so the pin does not rot. Implements reqstool/.github#25. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Implements reqstool/.github#25 for this repo.
Every
reqstool/.githubreference here now points at a commit SHA carrying a# 1.0.0comment, replacing the mix of
@mainand@<sha> # main <date>that had accumulated.reqstool/.githubwas tagged 1.0.0— its first ever tag — at the state verified end to end by this week's releases across all
nine publishing repos.
Why this shape, per the discussion on #25:
@mainis mutable, so CodeQL'sactions/unpinned-tagflags it, and a change toreqstool/.githubreaches this repo instantly with no review. We hit exactly that twicethis week while fixing the PyPI publish path.
@1.0.0alone would still be a mutable tag, so it would keep tripping the same rule.@<sha> # 1.0.0satisfies the pinning audits, and Renovate tracks the digest and rewritesthe version comment alongside it — so the pin does not silently rot. That is the same
treatment third-party actions already get in this org.
A companion PR narrows the
!/^reqstool\//exclusion inrenovate.json5, which is whatlets Renovate maintain these going forward. That one merges after this, so Renovate does
not try to pin
@mainrefs mid-sweep.Checklist
git commit -s).Test plan
Mechanical, generated by script and YAML-validated across every touched file. The refs all
resolve to the same tree they did before —
1.0.0points atef815ea, which is what@mainalready resolved to when this was written, so no behaviour changes. CI on this PR exercises
the pinned refs directly.