verify-action-build: recognise aube-lock.yaml as a node lock file

utils/tests/verify_action_build/test_security.py

@@ -678,6 +678,17 @@ def test_node_package_json_with_bun_lock_passes(self):
         }
         assert self._run(files) == []
 
+    def test_node_package_json_with_aube_lock_passes(self):
+        # apache/infrastructure-actions#1167: jdx/mise-action v4.2.4 moved its
+        # build to aube (jdx/aube), which writes aube-lock.yaml in pnpm's
+        # lockfileVersion 9 format — resolved versions plus sha512 integrity
+        # for every transitive dep, so the pinning guarantee is unchanged.
+        files = {
+            "package.json": '{"name":"x","dependencies":{"a":"1.0.0"}}',
+            "aube-lock.yaml": "lockfileVersion: '9.0'\n",
+        }
+        assert self._run(files) == []
+
     def test_node_package_json_without_lock_fails(self):
         # ``dependencies`` are declared, so the lock-file requirement applies.
         errors = self._run({

utils/verify_action_build/diff_source.py

@@ -55,7 +55,7 @@ def diff_approved_vs_new(
     excluded_dirs = {"dist", "node_modules", ".git", ".github", "__tests__", "__mocks__"}
     lock_files = {
         "package-lock.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb",
-        "shrinkwrap.json", "npm-shrinkwrap.json",
+        "aube-lock.yaml", "shrinkwrap.json", "npm-shrinkwrap.json",
     }
     source_extensions = {".js", ".ts", ".mjs", ".cjs", ".mts", ".cts", ".json", ".yml", ".yaml"}
 

utils/verify_action_build/dockerfiles/build_action.Dockerfile

@@ -177,7 +177,7 @@ RUN OUT_DIR=$(cat /out-dir.txt); \
 ARG APPROVED_HASH=""
 RUN if [ -n "$APPROVED_HASH" ]; then \
       echo "approved-hash: $APPROVED_HASH" >> /build-info.log; \
-      for f in package.json package-lock.json yarn.lock pnpm-lock.yaml; do \
+      for f in package.json package-lock.json yarn.lock pnpm-lock.yaml aube-lock.yaml; do \
         if [ -f "$f" ]; then \
           if git show "$APPROVED_HASH:$f" > "/tmp/approved-$f" 2>/dev/null; then \
             cp "/tmp/approved-$f" "$f"; \
@@ -215,6 +215,12 @@ RUN if [ "$(cat /has-node-modules.txt)" = "true" ]; then \
         corepack prepare --activate 2>/dev/null; \
         pnpm install --prod 2>/dev/null || pnpm install 2>/dev/null || true; \
         echo "node_modules-reinstall: pnpm --prod (in $BUILD_DIR)" >> /build-info.log; \
+      elif [ -f aube-lock.yaml ]; then \
+        cp aube-lock.yaml pnpm-lock.yaml; \
+        corepack prepare --activate 2>/dev/null; \
+        pnpm install --no-frozen-lockfile --prod 2>/dev/null || pnpm install --no-frozen-lockfile 2>/dev/null || true; \
+        rm -f pnpm-lock.yaml; \
+        echo "node_modules-reinstall: pnpm --prod via aube-lock.yaml (in $BUILD_DIR)" >> /build-info.log; \
       else \
         npm ci --production 2>/dev/null || npm install --production 2>/dev/null || true; \
         echo "node_modules-reinstall: npm --production (in $BUILD_DIR)" >> /build-info.log; \
@@ -236,6 +242,12 @@ RUN BUILD_DIR=$(cat /build-dir.txt); \
       corepack prepare --activate 2>/dev/null; \
       pnpm install 2>/dev/null || true; \
       echo "pkg-manager: pnpm (in $BUILD_DIR)" >> /build-info.log; \
+    elif [ -f aube-lock.yaml ]; then \
+      cp aube-lock.yaml pnpm-lock.yaml; \
+      corepack prepare --activate 2>/dev/null; \
+      pnpm install --no-frozen-lockfile 2>/dev/null || true; \
+      rm -f pnpm-lock.yaml; \
+      echo "pkg-manager: pnpm via aube-lock.yaml (in $BUILD_DIR)" >> /build-info.log; \
     else \
       npm ci 2>/dev/null || npm install 2>/dev/null || true; \
       echo "pkg-manager: npm (in $BUILD_DIR)" >> /build-info.log; \

utils/verify_action_build/security.py

@@ -680,7 +680,10 @@ def _find(name: str) -> tuple[str, str] | None:
 
     # (ecosystem, manifest, [acceptable lock files in priority order])
     ecosystems: list[tuple[str, str, list[str]]] = [
-        ("node",   "package.json",   ["package-lock.json", "yarn.lock", "pnpm-lock.yaml", "bun.lock", "bun.lockb"]),
+        # aube (jdx/aube) writes aube-lock.yaml in pnpm's lockfileVersion 9
+        # format — same resolved-version + sha512-integrity guarantees the
+        # other node lock files give, under a different filename.
+        ("node",   "package.json",   ["package-lock.json", "yarn.lock", "pnpm-lock.yaml", "bun.lock", "bun.lockb", "aube-lock.yaml"]),
         ("python", "pyproject.toml", ["uv.lock", "poetry.lock", "pdm.lock", "requirements.txt"]),
         ("python", "Pipfile",        ["Pipfile.lock"]),
         ("deno",   "deno.json",      ["deno.lock"]),
@@ -917,7 +920,7 @@ def analyze_dependency_pinning(
         except (json.JSONDecodeError, KeyError):
             pass
 
-    lock_files = ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"]
+    lock_files = ["package-lock.json", "yarn.lock", "pnpm-lock.yaml", "aube-lock.yaml"]
     if sub_path:
         lock_files = [f"{sub_path}/{lf}" for lf in lock_files] + lock_files
     for lf_path in lock_files: