ci: give Dependabot Actions bumps a 7-day cooldown - #154
Open
rominf wants to merge 1 commit into
Open
Conversation
Pinning actions to SHAs stops a tag from being moved under us, but it does not cover the moment we adopt a new SHA. A bump PR runs the new action's code on CI before anyone reads the diff, and because every path filter in ci.yml folds in `.github/workflows/**`, such a PR trips the `heavy` filter and reaches the self-hosted GPU lanes. Those runners persist caches and build state across jobs, so anything that executes there outlives the run. GitHub already delays version updates by 3 days; published action compromises have gone unnoticed for longer, so wait 7. Cooldown applies to version updates only, so security updates still land immediately. Signed-off-by: Roman Inflianskas <Roman.Inflianskas@amd.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cooldown: default-days: 7to thegithub-actionsDependabot ecosystem.Why. Pinning actions to SHAs prevents a tag being moved under us, but it does not cover the one moment the pin stops protecting us: adopting a new SHA. Dependabot's bump PR triggers
ci.yml, which executes the new action's code before any human has read the diff. So the window between "a release is published" and "we run it" is the exposure, and today it is only GitHub's implicit 3-day default.Why it matters more here than in a typical repo. Every path filter in
ci.ymlfolds in.github/workflows/**. An Actions bump edits exactly those files, so such a PR trips theheavyfilter and reaches the self-hosted GPU lanes (e2e-gpu,e2e-gpu-strix-*) — not just ephemeralubuntu-latestcontainers. Those runners deliberately persist state across jobs (the uv cache, the prewarm data dir, the target dir kept viacache: false), so anything that executes there outlives the run and is reused by later jobs, including jobs onmain.Why 7 days. Long enough to cover the interval in which published action compromises have typically been found and yanked; GitHub's implicit default of 3 days has been shorter than that interval in practice. Cooldown applies to version updates only — security updates are explicitly exempt and still land immediately.
Scope / non-goals
Deliberately not included, to keep this to one change — happy to follow up on either if maintainers want them:
github.actor != 'dependabot[bot]'. This would remove the persistent-runner exposure outright rather than just delaying it; the tradeoff is that an Actions bump then gets GPU-lane validation only after merge (those jobs arecontinue-on-error: true, so they gate nothing today).actions/*from third-party actions into separate groups, so a third-party bump can't ride along in a batch of routine ones.Test plan
.github/dependabot.ymlparses and yields the intended structure (cooldown.default-days: 7alongside the existingscheduleandgroups);prek run --all-files --no-group local-toolspasses, includingcheck-yaml.default-daysis documented as supported for every listed package manager, GitHub Actions included. Onlydefault-daysis used — thesemver-*-daysvariants are documented as applying "only to package managers supporting SemVer", and I did not confirm GitHub Actions is one of them.No local verification of Dependabot's runtime behavior is possible; that is observable only on the next scheduled run.
If this PR fixes a bug, searched
tests/e2e-cucumber/expectations.tomlfor the fixed ticket ID and removed/narrowed any now-stale xfail rows. — n/a, no bug fix.