From 019c03db3994fe7efa9e80ed52c39b66caee526e Mon Sep 17 00:00:00 2001 From: rgarcia <72655+rgarcia@users.noreply.github.com> Date: Fri, 13 Nov 2026 21:10:59 +0000 Subject: [PATCH 1/2] Lock workflow action dependencies with actions.lock --- .github/workflows/actions.lock | 38 +++++++++++++++++++++++++++ .github/workflows/ci.yml | 4 +-- .github/workflows/publish-release.yml | 6 ++--- .github/workflows/release-doctor.yml | 2 +- 4 files changed, 44 insertions(+), 6 deletions(-) create mode 100644 .github/workflows/actions.lock diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..f12502e --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,38 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/ci.yml': + - 'actions/checkout@v4.4.0' + - 'actions/setup-go@v5.6.0' + '.github/workflows/publish-release.yml': + - 'actions/checkout@v4.4.0' + - 'actions/create-github-app-token@v1.12.0' + - 'actions/setup-go@v5.6.0' + - 'goreleaser/goreleaser-action@v6.1.0' + '.github/workflows/release-doctor.yml': + - 'actions/checkout@v4.4.0' + '.github/workflows/semgrep.yml': [] + '.github/workflows/vuln-remediation.yml': [] +dependencies: + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 + 'actions/create-github-app-token@v1.12.0': + ref: 'v1.12.0' + commit: 'sha1-d72941d797fd3113feb6b93fd0dec494b13a2547' + owner_id: 44036562 + repo_id: 642580244 + 'actions/setup-go@v5.6.0': + ref: 'v5.6.0' + commit: 'sha1-40f1582b2485089dde7abd97c1529aa768e1baff' + owner_id: 44036562 + repo_id: 192624594 + 'goreleaser/goreleaser-action@v6.1.0': + ref: 'v6.1.0' + commit: 'sha1-9ed2f89a662bf1735a48bc8557fd212fa902bebf' + owner_id: 24697112 + repo_id: 209873006 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 697b7ff..85db7f7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,10 +20,10 @@ jobs: if: github.event_name == 'push' || github.event.pull_request.head.repo.fork steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Setup go - uses: actions/setup-go@v5 + uses: actions/setup-go@v5.6.0 with: go-version-file: ./go.mod diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 5088ad0..a6b7e42 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -16,18 +16,18 @@ jobs: steps: - name: Generate app token id: app-token - uses: actions/create-github-app-token@v1 + uses: actions/create-github-app-token@v1.12.0 with: app-id: ${{ secrets.ADMIN_APP_ID }} private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }} owner: kernel repositories: homebrew-tap - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v5.6.0 with: go-version-file: "go.mod" - name: Run GoReleaser diff --git a/.github/workflows/release-doctor.yml b/.github/workflows/release-doctor.yml index b293109..bab5313 100644 --- a/.github/workflows/release-doctor.yml +++ b/.github/workflows/release-doctor.yml @@ -12,7 +12,7 @@ jobs: if: github.repository == 'kernel/hypeman-cli' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next') steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Check release environment run: | From 34b8dd246ae87c50bff6167f1e374c728273df82 Mon Sep 17 00:00:00 2001 From: rgarcia <72655+rgarcia@users.noreply.github.com> Date: Fri, 13 Nov 2026 21:28:13 +0000 Subject: [PATCH 2/2] Generate actions.lock without rewriting generated uses: lines --- .github/workflows/actions.lock | 24 ++++++++++++------------ .github/workflows/ci.yml | 4 ++-- .github/workflows/publish-release.yml | 6 +++--- .github/workflows/release-doctor.yml | 2 +- 4 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index f12502e..bd31cf6 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -4,30 +4,30 @@ version: 'v0.0.3' workflows: '.github/workflows/ci.yml': - - 'actions/checkout@v4.4.0' - - 'actions/setup-go@v5.6.0' + - 'actions/checkout@v4' + - 'actions/setup-go@v5' '.github/workflows/publish-release.yml': - - 'actions/checkout@v4.4.0' - - 'actions/create-github-app-token@v1.12.0' - - 'actions/setup-go@v5.6.0' + - 'actions/checkout@v4' + - 'actions/create-github-app-token@v1' + - 'actions/setup-go@v5' - 'goreleaser/goreleaser-action@v6.1.0' '.github/workflows/release-doctor.yml': - - 'actions/checkout@v4.4.0' + - 'actions/checkout@v4' '.github/workflows/semgrep.yml': [] '.github/workflows/vuln-remediation.yml': [] dependencies: - 'actions/checkout@v4.4.0': - ref: 'v4.4.0' + 'actions/checkout@v4': + ref: 'v4' commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' owner_id: 44036562 repo_id: 197814629 - 'actions/create-github-app-token@v1.12.0': - ref: 'v1.12.0' + 'actions/create-github-app-token@v1': + ref: 'v1' commit: 'sha1-d72941d797fd3113feb6b93fd0dec494b13a2547' owner_id: 44036562 repo_id: 642580244 - 'actions/setup-go@v5.6.0': - ref: 'v5.6.0' + 'actions/setup-go@v5': + ref: 'v5' commit: 'sha1-40f1582b2485089dde7abd97c1529aa768e1baff' owner_id: 44036562 repo_id: 192624594 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 85db7f7..697b7ff 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,10 +20,10 @@ jobs: if: github.event_name == 'push' || github.event.pull_request.head.repo.fork steps: - - uses: actions/checkout@v4.4.0 + - uses: actions/checkout@v4 - name: Setup go - uses: actions/setup-go@v5.6.0 + uses: actions/setup-go@v5 with: go-version-file: ./go.mod diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index a6b7e42..5088ad0 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -16,18 +16,18 @@ jobs: steps: - name: Generate app token id: app-token - uses: actions/create-github-app-token@v1.12.0 + uses: actions/create-github-app-token@v1 with: app-id: ${{ secrets.ADMIN_APP_ID }} private-key: ${{ secrets.ADMIN_APP_PRIVATE_KEY }} owner: kernel repositories: homebrew-tap - name: Checkout - uses: actions/checkout@v4.4.0 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v5.6.0 + uses: actions/setup-go@v5 with: go-version-file: "go.mod" - name: Run GoReleaser diff --git a/.github/workflows/release-doctor.yml b/.github/workflows/release-doctor.yml index bab5313..b293109 100644 --- a/.github/workflows/release-doctor.yml +++ b/.github/workflows/release-doctor.yml @@ -12,7 +12,7 @@ jobs: if: github.repository == 'kernel/hypeman-cli' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next') steps: - - uses: actions/checkout@v4.4.0 + - uses: actions/checkout@v4 - name: Check release environment run: |