Enhancement Request
Current action implementation consists of several composite actions that internally reference each other. Due to GitHub limitations, these internal references must be fully qualified action names, including @<version|branch|SHA>. We can't know the commit SHA upfront (chicken-and-egg problem), so only option is to use @<version> or @<branch>, which has been implemented through the update-action-refs.sh script.
Problem with this approach is that this action implementation cannot be used if GitHub is configured to require actions to be pinned by SHA.
As a workaround, we could have every sub-action provide its own full implementation through re-usable scripts, effectively removing all internal action references. Note that we'd also need to use SHA pinning for actions/upload-artifact and any other 3rd-party actions, instead of referencing these by major version, which increases maintenance which could potentially be automated through an auto-update workflow.
Enhancement Request
Current action implementation consists of several composite actions that internally reference each other. Due to GitHub limitations, these internal references must be fully qualified action names, including
@<version|branch|SHA>. We can't know the commit SHA upfront (chicken-and-egg problem), so only option is to use@<version>or@<branch>, which has been implemented through theupdate-action-refs.shscript.Problem with this approach is that this action implementation cannot be used if GitHub is configured to require actions to be pinned by SHA.
As a workaround, we could have every sub-action provide its own full implementation through re-usable scripts, effectively removing all internal action references. Note that we'd also need to use SHA pinning for
actions/upload-artifactand any other 3rd-party actions, instead of referencing these by major version, which increases maintenance which could potentially be automated through an auto-update workflow.