Skip to content

Lock GitHub Actions dependencies with a workflow lockfile #249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MohamedBassem merged 2 commits into from
Oct 28, 2026
Merged

Lock GitHub Actions dependencies with a workflow lockfile #249

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ddd18bd
Lock GitHub Actions dependencies with a workflow lockfile
MohamedBassem Oct 28, 2026
78df13b
Pin verify-lockfile to gh-actions-lock v0.4.0
MohamedBassem Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
168 changes: 168 additions & 0 deletions .github/workflows/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,168 @@
# This file is machine-generated by `gh actions-lock`.
# Do not edit by hand; run `gh actions-lock` to update.
# Docs: https://gh.io/actions-lockfile
version: 'v0.0.3'
workflows:
'.github/workflows/cla.yml': []
'.github/workflows/docker.yml':
- 'actions/checkout@v4.4.0'
- 'docker/build-push-action@v3.3.1'
- 'docker/login-action@v2.2.0'
- 'docker/metadata-action@v5.10.0'
- 'docker/setup-buildx-action@v3.12.0'
- 'docker/setup-qemu-action@v2.2.0'
'.github/workflows/integration.yaml':
- 'actions/checkout@v4.4.0'
- 'actions/download-artifact@v8.0.2'
- 'dawidd6/action-download-artifact@v3.1.4'
- 'docker/build-push-action@v6.19.2'
- 'docker/setup-buildx-action@v3.12.0'
- 'docker/setup-docker-action@v4.7.0'
- 'docker/setup-qemu-action@v3.7.0'
- 'restatedev/e2e@v2.2'
'.github/workflows/release.yml':
- 'actions/attest-build-provenance@v2.4.0'
- 'actions/checkout@v4.4.0'
- 'actions/download-artifact@v4.3.0'
- 'actions/setup-python@v5.6.0'
- 'actions/upload-artifact@v4.6.2'
- 'pyo3/maturin-action@v1.51.0'
'.github/workflows/test.yml':
- 'actions/checkout@v4.4.0'
- 'astral-sh/setup-uv@v5.4.2'
- 'extractions/setup-just@v2.0.0'
'.github/workflows/verify-lockfile.yml':
- 'actions/checkout@v7.0.1'
dependencies:
'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01':
ref: 'predicate@1.1.5'
commit: 'sha1-1176ef556905f349f669722abf30bce1a6e16e01'
owner_id: 44036562
repo_id: 760702757
'actions/attest-build-provenance@v2.4.0':
ref: 'v2.4.0'
commit: 'sha1-e8998f949152b193b063cb0ec769d69d929409be'
owner_id: 44036562
repo_id: 760702757
uses:
- 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01'
- 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc'
'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc':
ref: 'v2.4.0'
commit: 'sha1-ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc'
owner_id: 44036562
repo_id: 760701061
'actions/checkout@v4.4.0':
ref: 'v4.4.0'
commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
owner_id: 44036562
repo_id: 197814629
'actions/checkout@v7.0.1':
ref: 'v7.0.1'
commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
'actions/download-artifact@v4.3.0':
ref: 'v4.3.0'
commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
owner_id: 44036562
repo_id: 192626254
'actions/download-artifact@v8.0.2':
ref: 'v8.0.2'
commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
owner_id: 44036562
repo_id: 192626254
'actions/setup-java@v4':
ref: 'v4'
commit: 'sha1-cf277c60eb25467037889841efdb72551f06f6c3'
owner_id: 44036562
repo_id: 196057608
'actions/setup-python@v5.6.0':
ref: 'v5.6.0'
commit: 'sha1-a26af69be951a213d495a4c3e4e4022e16d87065'
owner_id: 44036562
repo_id: 192625525
'actions/upload-artifact@v4':
ref: 'v4'
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
owner_id: 44036562
repo_id: 192625955
'actions/upload-artifact@v4.6.2':
ref: 'v4.6.2'
commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
owner_id: 44036562
repo_id: 192625955
'astral-sh/setup-uv@v5.4.2':
ref: 'v5.4.2'
commit: 'sha1-d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86'
owner_id: 115962839
repo_id: 846733598
'dawidd6/action-download-artifact@v3.1.4':
ref: 'v3.1.4'
commit: 'sha1-09f2f74827fd3a8607589e5ad7f9398816f540fe'
owner_id: 9713907
repo_id: 239218448
'docker/build-push-action@v3.3.1':
ref: 'v3.3.1'
commit: 'sha1-1104d471370f9806843c095c1db02b5a90c5f8b6'
owner_id: 5429470
repo_id: 241092383
'docker/build-push-action@v6.19.2':
ref: 'v6.19.2'
commit: 'sha1-10e90e3645eae34f1e60eeb005ba3a3d33f178e8'
owner_id: 5429470
repo_id: 241092383
'docker/login-action@v2.2.0':
ref: 'v2.2.0'
commit: 'sha1-465a07811f14bebb1938fbed4728c6a1ff8901fc'
owner_id: 5429470
repo_id: 287743349
'docker/metadata-action@v5.10.0':
ref: 'v5.10.0'
commit: 'sha1-c299e40c65443455700f0fdfc63efafe5b349051'
owner_id: 5429470
repo_id: 306769011
'docker/setup-buildx-action@v3.12.0':
ref: 'v3.12.0'
commit: 'sha1-8d2750c68a42422c14e847fe6c8ac0403b4cbd6f'
owner_id: 5429470
repo_id: 288485773
'docker/setup-docker-action@v4.7.0':
ref: 'v4.7.0'
commit: 'sha1-e43656e248c0bd0647d3f5c195d116aacf6fcaf4'
owner_id: 5429470
repo_id: 398780917
'docker/setup-qemu-action@v2.2.0':
ref: 'v2.2.0'
commit: 'sha1-2b82ce82d56a2a04d2637cd93a637ae1b359c0a7'
owner_id: 5429470
repo_id: 288487894
'docker/setup-qemu-action@v3.7.0':
ref: 'v3.7.0'
commit: 'sha1-c7c53464625b32c7a7e944ae62b3e17d2b600130'
owner_id: 5429470
repo_id: 288487894
'enricomi/publish-unit-test-result-action@v2':
ref: 'v2'
commit: 'sha1-7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d'
owner_id: 44700269
repo_id: 290227969
'extractions/setup-just@v2.0.0':
ref: 'v2.0.0'
commit: 'sha1-dd310ad5a97d8e7b41793f8ef055398d51ad4de6'
owner_id: 64203070
repo_id: 258510356
'pyo3/maturin-action@v1.51.0':
ref: 'v1.51.0'
commit: 'sha1-e83996d129638aa358a18fbd1dfb82f0b0fb5d3b'
owner_id: 28156855
repo_id: 363801746
'restatedev/e2e@v2.2':
ref: 'v2.2'
commit: 'sha1-edd926b59e51af418b95c143220c0a2a62b7fd7b'
owner_id: 97341811
repo_id: 489007488
uses:
- 'actions/setup-java@v4'
- 'actions/upload-artifact@v4'
- 'enricomi/publish-unit-test-result-action@v2'
12 changes: 6 additions & 6 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,27 +18,27 @@ jobs:
runs-on: warp-ubuntu-latest-x64-4x
steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@v4.4.0

- name: Set up QEMU dependency
uses: docker/setup-qemu-action@v2
uses: docker/setup-qemu-action@v2.2.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v3.12.0
with:
driver-opts: |
network=host

- name: Log into GitHub container registry
uses: docker/login-action@v2
uses: docker/login-action@v2.2.0
with:
registry: ${{ env.GHCR_REGISTRY }}
username: ${{ env.GHCR_REGISTRY_USERNAME }}
password: ${{ env.GHCR_REGISTRY_TOKEN }}

- name: Extract metadata (tags, labels)
id: meta
uses: docker/metadata-action@v5
uses: docker/metadata-action@v5.10.0
with:
images: |
ghcr.io/restatedev/test-services-python
Expand All @@ -48,7 +48,7 @@ jobs:
type=semver,pattern={{major}}.{{minor}}

- name: Build docker image
uses: docker/build-push-action@v3
uses: docker/build-push-action@v3.3.1
with:
context: .
file: test-services/Dockerfile
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/integration.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,13 +68,13 @@ jobs:
actions: read

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v4.4.0
with:
repository: restatedev/sdk-python
ref: ${{ inputs.sdkRepoRef }}

- name: Set up Docker containerd snapshotter
uses: docker/setup-docker-action@v4
uses: docker/setup-docker-action@v4.7.0
with:
version: "v28.5.2"
set-host: true
Expand All @@ -91,13 +91,13 @@ jobs:
# We must use download-artifact to get artifacts created during *this* workflow run, ie by workflow call
- name: Download restate snapshot from in-progress workflow
if: ${{ inputs.restateCommit != '' && github.event_name != 'workflow_dispatch' }}
uses: actions/download-artifact@v8
uses: actions/download-artifact@v8.0.2
with:
name: restate.tar
# In the workflow dispatch case where the artifact was created in a previous run, we can download as normal
- name: Download restate snapshot from completed workflow
if: ${{ inputs.restateCommit != '' && github.event_name == 'workflow_dispatch' }}
uses: dawidd6/action-download-artifact@v3
uses: dawidd6/action-download-artifact@v3.1.4
with:
repo: restatedev/restate
workflow: ci.yml
Expand All @@ -113,17 +113,17 @@ jobs:
# Either build the docker image from source
- name: Set up QEMU
if: ${{ inputs.serviceImage == '' }}
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@v3.7.0
- name: Set up Docker Buildx
if: ${{ inputs.serviceImage == '' }}
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v3.12.0
with:
driver-opts: |
network=host
- name: Build Python test-services image
if: ${{ inputs.serviceImage == '' }}
id: build
uses: docker/build-push-action@v6
uses: docker/build-push-action@v6.19.2
with:
context: .
file: "test-services/Dockerfile"
Expand Down
38 changes: 19 additions & 19 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
version-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v4.4.0
- name: Install dasel
run: |
wget -q https://github.com/TomWright/dasel/releases/download/v2.8.1/dasel_linux_amd64 && \
Expand Down Expand Up @@ -42,20 +42,20 @@ jobs:
- runner: ubuntu-latest
target: aarch64
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
- uses: actions/checkout@v4.4.0
- uses: actions/setup-python@v5.6.0
with:
python-version: 3.x
- name: Build wheels
uses: PyO3/maturin-action@v1
uses: PyO3/maturin-action@v1.51.0
with:
target: ${{ matrix.platform.target }}
args: --release --out dist --find-interpreter
sccache: 'false'
# See https://github.com/PyO3/maturin-action/issues/222
manylinux: ${{ matrix.platform.target == 'aarch64' && '2_28' || 'auto' }}
- name: Upload wheels
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v4.6.2
with:
name: wheels-linux-${{ matrix.platform.target }}
path: dist
Expand All @@ -71,19 +71,19 @@ jobs:
- runner: ubuntu-latest
target: aarch64
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
- uses: actions/checkout@v4.4.0
- uses: actions/setup-python@v5.6.0
with:
python-version: 3.x
- name: Build wheels
uses: PyO3/maturin-action@v1
uses: PyO3/maturin-action@v1.51.0
with:
target: ${{ matrix.platform.target }}
args: --release --out dist --find-interpreter
sccache: 'false'
manylinux: musllinux_1_2
- name: Upload wheels
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v4.6.2
with:
name: wheels-musllinux-${{ matrix.platform.target }}
path: dist
Expand All @@ -99,18 +99,18 @@ jobs:
- runner: macos-14
target: aarch64
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
- uses: actions/checkout@v4.4.0
- uses: actions/setup-python@v5.6.0
with:
python-version: 3.x
- name: Build wheels
uses: PyO3/maturin-action@v1
uses: PyO3/maturin-action@v1.51.0
with:
target: ${{ matrix.platform.target }}
args: --release --out dist --find-interpreter
sccache: 'true'
- name: Upload wheels
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v4.6.2
with:
name: wheels-macos-${{ matrix.platform.target }}
path: dist
Expand All @@ -119,14 +119,14 @@ jobs:
runs-on: ubuntu-latest
needs: [version-check]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v4.4.0
- name: Build sdist
uses: PyO3/maturin-action@v1
uses: PyO3/maturin-action@v1.51.0
with:
command: sdist
args: --out dist
- name: Upload sdist
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v4.6.2
with:
name: wheels-sdist
path: dist
Expand All @@ -143,13 +143,13 @@ jobs:
# Used to generate artifact attestation
attestations: write
steps:
- uses: actions/download-artifact@v4
- uses: actions/download-artifact@v4.3.0
- name: Generate artifact attestation
uses: actions/attest-build-provenance@v2
uses: actions/attest-build-provenance@v2.4.0
with:
subject-path: 'wheels-*/*'
- name: Publish to PyPI
uses: PyO3/maturin-action@v1
uses: PyO3/maturin-action@v1.51.0
env:
MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
with:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,9 @@ jobs:
env:
UV_PYTHON: ${{ matrix.python }}
steps:
- uses: actions/checkout@v4
- uses: extractions/setup-just@v2
- uses: astral-sh/setup-uv@v5
- uses: actions/checkout@v4.4.0
- uses: extractions/setup-just@v2.0.0
- uses: astral-sh/setup-uv@v5.4.2
with:
enable-cache: true
- name: Install dependencies
Expand Down
Loading
Loading