From 9761fb651aaf38acd4471ac0a7d3179ba9a64b4f Mon Sep 17 00:00:00 2001 From: Akinori Musha Date: Mon, 2 Nov 2026 21:06:40 +0900 Subject: [PATCH] Lock workflow action dependencies Track direct and transitive action commits in actions.lock and verify coverage and provenance in CI. Preserve existing action versions except for the approved maintenance Action v2 adoption. --- .github/renovate.json5 | 15 ++++++++ .github/workflows/actions-lock.yml | 29 ++++++++++++++++ .github/workflows/actions.lock | 40 ++++++++++++++++++++++ .github/workflows/ci.yml | 16 ++++----- .github/workflows/lockfile-maintenance.yml | 9 ++++- .github/workflows/release.yml | 8 ++--- 6 files changed, 104 insertions(+), 13 deletions(-) create mode 100644 .github/workflows/actions-lock.yml create mode 100644 .github/workflows/actions.lock diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 6832a09..545eafc 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -21,6 +21,21 @@ labels: ["dependencies", "security"], }, packageRules: [ + { + "matchManagers": [ + "github-actions" + ], + "matchDepTypes": [ + "action" + ], + "matchFileNames": [ + ".github/workflows/ci.yml", + ".github/workflows/lockfile-maintenance.yml", + ".github/workflows/release.yml", + ".github/workflows/actions-lock.yml" + ], + "pinDigests": false + }, { matchUpdateTypes: ["major"], addLabels: ["dependencies:major"], diff --git a/.github/workflows/actions-lock.yml b/.github/workflows/actions-lock.yml new file mode 100644 index 0000000..e3afe59 --- /dev/null +++ b/.github/workflows/actions-lock.yml @@ -0,0 +1,29 @@ +name: Verify action lockfile +on: + pull_request: null + push: + branches: + - main +permissions: + contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true +jobs: + verify: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Harden Runner + uses: step-security/harden-runner@v2.22.2 + with: + egress-policy: audit + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - name: Verify workflow dependencies + env: + GH_TOKEN: ${{ github.token }} + run: | + gh extension install github/gh-actions-lock --pin v0.4.0 + gh actions-lock --verify diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..94a6ed7 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,40 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/actions-lock.yml': + - 'actions/checkout@v7.0.1' + - 'step-security/harden-runner@v2.22.2' + '.github/workflows/ci.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-node@v7.1.0' + - 'pnpm/action-setup@v6.1.0' + - 'step-security/harden-runner@v2.22.2' + '.github/workflows/lockfile-maintenance.yml': [] + '.github/workflows/release.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-node@v7.1.0' + - 'pnpm/action-setup@v6.1.0' + - 'step-security/harden-runner@v2.22.2' +dependencies: + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/setup-node@v7.1.0': + ref: 'v7.1.0' + commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1' + owner_id: 44036562 + repo_id: 189476904 + 'pnpm/action-setup@v6.1.0': + ref: 'v6.1.0' + commit: 'sha1-ea17c68df8912ef543352723c149a84f56e3d413' + owner_id: 21320719 + repo_id: 262289747 + 'step-security/harden-runner@v2.22.2': + ref: 'v2.22.2' + commit: 'sha1-dc2769abcc0fcfbadfc1df54081c1608579ef6b2' + owner_id: 88700172 + repo_id: 422287306 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 778afa2..fc7fc68 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,17 +19,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@v2.22.2 with: egress-policy: audit - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 + - uses: pnpm/action-setup@v6.1.0 - - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + - uses: actions/setup-node@v7.1.0 with: node-version-file: .nvmrc cache: pnpm @@ -51,17 +51,17 @@ jobs: browser: [chrome, edge, firefox] steps: - name: Harden Runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@v2.22.2 with: egress-policy: audit - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 + - uses: pnpm/action-setup@v6.1.0 - - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + - uses: actions/setup-node@v7.1.0 with: node-version-file: .nvmrc cache: pnpm diff --git a/.github/workflows/lockfile-maintenance.yml b/.github/workflows/lockfile-maintenance.yml index 832a432..d312a70 100644 --- a/.github/workflows/lockfile-maintenance.yml +++ b/.github/workflows/lockfile-maintenance.yml @@ -8,6 +8,13 @@ permissions: id-token: write jobs: maintenance: - uses: knu/lockfile-maintenance-action/.github/workflows/maintenance.yml@3d087d142fbe60099a43d649279de30c02f94731 # v2.1.2 + uses: knu/lockfile-maintenance-action/.github/workflows/maintenance.yml@bfe008c400f3507b5e60a6090038d5cfb72261c8 # v2.2.0 with: files: /pnpm-lock.yaml + + actions-lock: + uses: knu/lockfile-maintenance-action/.github/workflows/maintenance.yml@bfe008c400f3507b5e60a6090038d5cfb72261c8 + with: + files: /.github/workflows/actions.lock + minimum-release-age: 7 days + branch: automation/actions-lock-maintenance diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index efb9760..fa032b2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,19 +26,19 @@ jobs: contents: write steps: - name: Harden Runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@v2.22.2 with: egress-policy: audit - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7.0.1 with: ref: ${{ github.event.workflow_run.head_sha }} fetch-depth: 0 persist-credentials: false - - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 + - uses: pnpm/action-setup@v6.1.0 - - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + - uses: actions/setup-node@v7.1.0 with: node-version-file: .nvmrc cache: pnpm