Pin actions in caller templates and composite action - #39
Merged
Conversation
PR #37 SHA-pinned every action in .github/workflows/, but the scan missed two file classes that also reference external actions: the composite action definitions under .github/actions/ and the caller workflow templates distributed to org repos. actions/add-to-project v1.0.2 -> v2.0.0 in auto-add-to-project. The only difference between the two upstream action.yml files is the runtime (node20 -> node24); inputs and outputs are identical, and the caller template runs on ubuntu-latest. Supersedes the Renovate PR #22. Drops the adjacent comment about pinning to a specific release, which the SHA pin makes redundant. actions/create-github-app-token v1 -> v3.2.0 in both caller workflow templates (3 refs). Same upgrade already applied to this repo's own workflows: all call sites pass the hyphenated app-id and private-key inputs that v2 made mandatory, and no proxy is in play for the v3 NODE_USE_ENV_PROXY change. Adds helpers:pinGitHubActionDigests to renovate.json so Renovate maintains digest pins instead of proposing bare tag refs, which config:recommended alone does not do.
|
3keyroman
approved these changes
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
#37 SHA-pinned every action in
.github/workflows/, but that scan covered only workflow files. Two other file classes in this repo reference external actions and were missed:.github/actions/**/action.yml— composite action definitionstemplates/caller-workflows/*.yml— the caller workflows distributed to every org repo byrepo-template-syncThis PR closes that gap and stops it reopening.
Changes
.github/actions/auto-add-to-project/action.ymlactions/add-to-projectv1.0.25afcf9...57fd # v2.0.0templates/caller-workflows/issue-automation.ymlactions/create-github-app-token(2x)v1bcd2ba...3eb1 # v3.2.0templates/caller-workflows/release-automation.ymlactions/create-github-app-token(1x)v1bcd2ba...3eb1 # v3.2.0renovate.jsonconfig:recommended+ helpers:pinGitHubActionDigestsAfter this, the only unpinned
uses:refs left in the repo are the intentional org-internal moving tags:resolve-trivy-config@mainand the@issue-automation-v1/@release-automation-v1composite action pins.Why add-to-project v2.0.0 is safe
Diffing the upstream
action.ymlbetweenv1.0.2andv2.0.0, the entire difference is the runtime:Inputs (
project-url,github-token,labeled,label-operator) and outputs (itemId) are byte-identical. node24 needs Actions Runner >= 2.327.1; the caller template runsubuntu-latest, GitHub-hosted, so that is satisfied. v2.0.0 has been out since 2026-05-04.The bundled
dist/index.jsdid absorb sizeable octokit bumps (@octokit/request8 -> 10,plugin-paginate-rest9 -> 13). The action contract is unchanged, but that internal churn is not visible from the manifest.Supersedes #22, which proposed the same bump as a bare
@v2.0.0tag rather than a digest.Why create-github-app-token v3.2.0 is safe
Identical reasoning to #37, applied to the template copies. v2 removed the deprecated
app_id/private_key/skip_token_revokeinputs — all three call sites already pass the hyphenatedapp-id/private-key. v3's breaking changes are node24 (hosted runners) and requiringNODE_USE_ENV_PROXYfor proxy support (no proxy in use). Both templates runubuntu-latest.This also removes a live inconsistency: #37 moved this repo onto v3.2.0 while the template shipped to ~60 org repos still carried the unmaintained v1 line.
Renovate preset
config:recommendeddoes not include digest pinning, which is why Renovate proposed@v2.0.0rather than a SHA. Addinghelpers:pinGitHubActionDigestsmakes Renovate pin new action refs to digests and keep existing pins updated with their# tagcomments intact, so the posture #37 established does not erode.Rollout notes
Two follow-on steps are needed for these changes to reach org repos — neither happens on merge:
issue-automation-v1must be moved. Consuming repos referenceauto-add-to-project@issue-automation-v1, and that tag currently points at379a25a, well behindmain. The add-to-project bump is inert until the tag is moved.repo-template-syncmust be dispatched to propagate the two caller-workflow templates. Worth adry_run: truepass first — it also exercises the app-token v3 and checkout v7 changes from Update GitHub Actions to latest versions #37 without opening PRs anywhere.