From ddd18bd876d153bf166fc1d541709481ac3d7bd1 Mon Sep 17 00:00:00 2001 From: MohamedBassem Date: Wed, 28 Oct 2026 14:42:10 +0000 Subject: [PATCH 1/2] Lock GitHub Actions dependencies with a workflow lockfile --- .github/workflows/actions.lock | 168 ++++++++++++++++++++++++++ .github/workflows/docker.yml | 12 +- .github/workflows/integration.yaml | 14 +-- .github/workflows/release.yml | 38 +++--- .github/workflows/test.yml | 6 +- .github/workflows/verify-lockfile.yml | 25 ++++ 6 files changed, 228 insertions(+), 35 deletions(-) create mode 100644 .github/workflows/actions.lock create mode 100644 .github/workflows/verify-lockfile.yml diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 00000000..71860371 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,168 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/cla.yml': [] + '.github/workflows/docker.yml': + - 'actions/checkout@v4.4.0' + - 'docker/build-push-action@v3.3.1' + - 'docker/login-action@v2.2.0' + - 'docker/metadata-action@v5.10.0' + - 'docker/setup-buildx-action@v3.12.0' + - 'docker/setup-qemu-action@v2.2.0' + '.github/workflows/integration.yaml': + - 'actions/checkout@v4.4.0' + - 'actions/download-artifact@v8.0.2' + - 'dawidd6/action-download-artifact@v3.1.4' + - 'docker/build-push-action@v6.19.2' + - 'docker/setup-buildx-action@v3.12.0' + - 'docker/setup-docker-action@v4.7.0' + - 'docker/setup-qemu-action@v3.7.0' + - 'restatedev/e2e@v2.2' + '.github/workflows/release.yml': + - 'actions/attest-build-provenance@v2.4.0' + - 'actions/checkout@v4.4.0' + - 'actions/download-artifact@v4.3.0' + - 'actions/setup-python@v5.6.0' + - 'actions/upload-artifact@v4.6.2' + - 'pyo3/maturin-action@v1.51.0' + '.github/workflows/test.yml': + - 'actions/checkout@v4.4.0' + - 'astral-sh/setup-uv@v5.4.2' + - 'extractions/setup-just@v2.0.0' + '.github/workflows/verify-lockfile.yml': + - 'actions/checkout@v7.0.1' +dependencies: + 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01': + ref: 'predicate@1.1.5' + commit: 'sha1-1176ef556905f349f669722abf30bce1a6e16e01' + owner_id: 44036562 + repo_id: 760702757 + 'actions/attest-build-provenance@v2.4.0': + ref: 'v2.4.0' + commit: 'sha1-e8998f949152b193b063cb0ec769d69d929409be' + owner_id: 44036562 + repo_id: 760702757 + uses: + - 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01' + - 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc' + 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc': + ref: 'v2.4.0' + commit: 'sha1-ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc' + owner_id: 44036562 + repo_id: 760701061 + 'actions/checkout@v4.4.0': + ref: 'v4.4.0' + commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262' + owner_id: 44036562 + repo_id: 197814629 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/download-artifact@v4.3.0': + ref: 'v4.3.0' + commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093' + owner_id: 44036562 + repo_id: 192626254 + 'actions/download-artifact@v8.0.2': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' + owner_id: 44036562 + repo_id: 192626254 + 'actions/setup-java@v4': + ref: 'v4' + commit: 'sha1-cf277c60eb25467037889841efdb72551f06f6c3' + owner_id: 44036562 + repo_id: 196057608 + 'actions/setup-python@v5.6.0': + ref: 'v5.6.0' + commit: 'sha1-a26af69be951a213d495a4c3e4e4022e16d87065' + owner_id: 44036562 + repo_id: 192625525 + 'actions/upload-artifact@v4': + ref: 'v4' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'actions/upload-artifact@v4.6.2': + ref: 'v4.6.2' + commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02' + owner_id: 44036562 + repo_id: 192625955 + 'astral-sh/setup-uv@v5.4.2': + ref: 'v5.4.2' + commit: 'sha1-d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86' + owner_id: 115962839 + repo_id: 846733598 + 'dawidd6/action-download-artifact@v3.1.4': + ref: 'v3.1.4' + commit: 'sha1-09f2f74827fd3a8607589e5ad7f9398816f540fe' + owner_id: 9713907 + repo_id: 239218448 + 'docker/build-push-action@v3.3.1': + ref: 'v3.3.1' + commit: 'sha1-1104d471370f9806843c095c1db02b5a90c5f8b6' + owner_id: 5429470 + repo_id: 241092383 + 'docker/build-push-action@v6.19.2': + ref: 'v6.19.2' + commit: 'sha1-10e90e3645eae34f1e60eeb005ba3a3d33f178e8' + owner_id: 5429470 + repo_id: 241092383 + 'docker/login-action@v2.2.0': + ref: 'v2.2.0' + commit: 'sha1-465a07811f14bebb1938fbed4728c6a1ff8901fc' + owner_id: 5429470 + repo_id: 287743349 + 'docker/metadata-action@v5.10.0': + ref: 'v5.10.0' + commit: 'sha1-c299e40c65443455700f0fdfc63efafe5b349051' + owner_id: 5429470 + repo_id: 306769011 + 'docker/setup-buildx-action@v3.12.0': + ref: 'v3.12.0' + commit: 'sha1-8d2750c68a42422c14e847fe6c8ac0403b4cbd6f' + owner_id: 5429470 + repo_id: 288485773 + 'docker/setup-docker-action@v4.7.0': + ref: 'v4.7.0' + commit: 'sha1-e43656e248c0bd0647d3f5c195d116aacf6fcaf4' + owner_id: 5429470 + repo_id: 398780917 + 'docker/setup-qemu-action@v2.2.0': + ref: 'v2.2.0' + commit: 'sha1-2b82ce82d56a2a04d2637cd93a637ae1b359c0a7' + owner_id: 5429470 + repo_id: 288487894 + 'docker/setup-qemu-action@v3.7.0': + ref: 'v3.7.0' + commit: 'sha1-c7c53464625b32c7a7e944ae62b3e17d2b600130' + owner_id: 5429470 + repo_id: 288487894 + 'enricomi/publish-unit-test-result-action@v2': + ref: 'v2' + commit: 'sha1-7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d' + owner_id: 44700269 + repo_id: 290227969 + 'extractions/setup-just@v2.0.0': + ref: 'v2.0.0' + commit: 'sha1-dd310ad5a97d8e7b41793f8ef055398d51ad4de6' + owner_id: 64203070 + repo_id: 258510356 + 'pyo3/maturin-action@v1.51.0': + ref: 'v1.51.0' + commit: 'sha1-e83996d129638aa358a18fbd1dfb82f0b0fb5d3b' + owner_id: 28156855 + repo_id: 363801746 + 'restatedev/e2e@v2.2': + ref: 'v2.2' + commit: 'sha1-edd926b59e51af418b95c143220c0a2a62b7fd7b' + owner_id: 97341811 + repo_id: 489007488 + uses: + - 'actions/setup-java@v4' + - 'actions/upload-artifact@v4' + - 'enricomi/publish-unit-test-result-action@v2' diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index b760a211..f20d9039 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -18,19 +18,19 @@ jobs: runs-on: warp-ubuntu-latest-x64-4x steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v4.4.0 - name: Set up QEMU dependency - uses: docker/setup-qemu-action@v2 + uses: docker/setup-qemu-action@v2.2.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v3.12.0 with: driver-opts: | network=host - name: Log into GitHub container registry - uses: docker/login-action@v2 + uses: docker/login-action@v2.2.0 with: registry: ${{ env.GHCR_REGISTRY }} username: ${{ env.GHCR_REGISTRY_USERNAME }} @@ -38,7 +38,7 @@ jobs: - name: Extract metadata (tags, labels) id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v5.10.0 with: images: | ghcr.io/restatedev/test-services-python @@ -48,7 +48,7 @@ jobs: type=semver,pattern={{major}}.{{minor}} - name: Build docker image - uses: docker/build-push-action@v3 + uses: docker/build-push-action@v3.3.1 with: context: . file: test-services/Dockerfile diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml index ea5e0852..1d3cd7b6 100644 --- a/.github/workflows/integration.yaml +++ b/.github/workflows/integration.yaml @@ -68,13 +68,13 @@ jobs: actions: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 with: repository: restatedev/sdk-python ref: ${{ inputs.sdkRepoRef }} - name: Set up Docker containerd snapshotter - uses: docker/setup-docker-action@v4 + uses: docker/setup-docker-action@v4.7.0 with: version: "v28.5.2" set-host: true @@ -91,13 +91,13 @@ jobs: # We must use download-artifact to get artifacts created during *this* workflow run, ie by workflow call - name: Download restate snapshot from in-progress workflow if: ${{ inputs.restateCommit != '' && github.event_name != 'workflow_dispatch' }} - uses: actions/download-artifact@v8 + uses: actions/download-artifact@v8.0.2 with: name: restate.tar # In the workflow dispatch case where the artifact was created in a previous run, we can download as normal - name: Download restate snapshot from completed workflow if: ${{ inputs.restateCommit != '' && github.event_name == 'workflow_dispatch' }} - uses: dawidd6/action-download-artifact@v3 + uses: dawidd6/action-download-artifact@v3.1.4 with: repo: restatedev/restate workflow: ci.yml @@ -113,17 +113,17 @@ jobs: # Either build the docker image from source - name: Set up QEMU if: ${{ inputs.serviceImage == '' }} - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v3.7.0 - name: Set up Docker Buildx if: ${{ inputs.serviceImage == '' }} - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v3.12.0 with: driver-opts: | network=host - name: Build Python test-services image if: ${{ inputs.serviceImage == '' }} id: build - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v6.19.2 with: context: . file: "test-services/Dockerfile" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f45d637d..b29b8024 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,7 +13,7 @@ jobs: version-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Install dasel run: | wget -q https://github.com/TomWright/dasel/releases/download/v2.8.1/dasel_linux_amd64 && \ @@ -42,12 +42,12 @@ jobs: - runner: ubuntu-latest target: aarch64 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v4.4.0 + - uses: actions/setup-python@v5.6.0 with: python-version: 3.x - name: Build wheels - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@v1.51.0 with: target: ${{ matrix.platform.target }} args: --release --out dist --find-interpreter @@ -55,7 +55,7 @@ jobs: # See https://github.com/PyO3/maturin-action/issues/222 manylinux: ${{ matrix.platform.target == 'aarch64' && '2_28' || 'auto' }} - name: Upload wheels - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: wheels-linux-${{ matrix.platform.target }} path: dist @@ -71,19 +71,19 @@ jobs: - runner: ubuntu-latest target: aarch64 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v4.4.0 + - uses: actions/setup-python@v5.6.0 with: python-version: 3.x - name: Build wheels - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@v1.51.0 with: target: ${{ matrix.platform.target }} args: --release --out dist --find-interpreter sccache: 'false' manylinux: musllinux_1_2 - name: Upload wheels - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: wheels-musllinux-${{ matrix.platform.target }} path: dist @@ -99,18 +99,18 @@ jobs: - runner: macos-14 target: aarch64 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v4.4.0 + - uses: actions/setup-python@v5.6.0 with: python-version: 3.x - name: Build wheels - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@v1.51.0 with: target: ${{ matrix.platform.target }} args: --release --out dist --find-interpreter sccache: 'true' - name: Upload wheels - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: wheels-macos-${{ matrix.platform.target }} path: dist @@ -119,14 +119,14 @@ jobs: runs-on: ubuntu-latest needs: [version-check] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Build sdist - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@v1.51.0 with: command: sdist args: --out dist - name: Upload sdist - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: wheels-sdist path: dist @@ -143,13 +143,13 @@ jobs: # Used to generate artifact attestation attestations: write steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v4.3.0 - name: Generate artifact attestation - uses: actions/attest-build-provenance@v2 + uses: actions/attest-build-provenance@v2.4.0 with: subject-path: 'wheels-*/*' - name: Publish to PyPI - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@v1.51.0 env: MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }} with: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index ec6aea17..87dab050 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,9 +21,9 @@ jobs: env: UV_PYTHON: ${{ matrix.python }} steps: - - uses: actions/checkout@v4 - - uses: extractions/setup-just@v2 - - uses: astral-sh/setup-uv@v5 + - uses: actions/checkout@v4.4.0 + - uses: extractions/setup-just@v2.0.0 + - uses: astral-sh/setup-uv@v5.4.2 with: enable-cache: true - name: Install dependencies diff --git a/.github/workflows/verify-lockfile.yml b/.github/workflows/verify-lockfile.yml new file mode 100644 index 00000000..7dcccf54 --- /dev/null +++ b/.github/workflows/verify-lockfile.yml @@ -0,0 +1,25 @@ +# Fails when .github/workflows/actions.lock is out of sync with the +# workflows or a locked pin no longer verifies upstream. + +name: verify-lockfile + +on: + pull_request: + push: + branches: + - main + +permissions: + contents: read + +jobs: + verify: + runs-on: ubuntu-latest + env: + GH_TOKEN: ${{ github.token }} + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - run: gh extension install github/gh-actions-lock --pin v0.2.0 + - run: gh actions-lock --verify From 78df13b8603d67a2d02b85afcf5a8dd2b3318aa5 Mon Sep 17 00:00:00 2001 From: MohamedBassem Date: Wed, 28 Oct 2026 14:49:17 +0000 Subject: [PATCH 2/2] Pin verify-lockfile to gh-actions-lock v0.4.0 The lockfile was generated with v0.4.0; v0.2.0 rejects run-only local actions. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/verify-lockfile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/verify-lockfile.yml b/.github/workflows/verify-lockfile.yml index 7dcccf54..a4e433b5 100644 --- a/.github/workflows/verify-lockfile.yml +++ b/.github/workflows/verify-lockfile.yml @@ -21,5 +21,5 @@ jobs: - uses: actions/checkout@v7.0.1 with: persist-credentials: false - - run: gh extension install github/gh-actions-lock --pin v0.2.0 + - run: gh extension install github/gh-actions-lock --pin v0.4.0 - run: gh actions-lock --verify