From 16b568c0718bb6ffd84c085658c1e5988600e4f8 Mon Sep 17 00:00:00 2001 From: jdx <216188+jdx@users.noreply.github.com> Date: Fri, 9 Oct 2026 20:04:09 +0000 Subject: [PATCH 1/3] chore(ci): switch to jactionlint v2 Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/auto-merge-release.yml | 1 + .github/workflows/release-plz.yml | 7 ++++ .github/workflows/test.yml | 7 ++++ hk.pkl | 8 +++-- mise.lock | 44 ++++++++++++------------ mise.toml | 2 +- 6 files changed, 44 insertions(+), 25 deletions(-) diff --git a/.github/workflows/auto-merge-release.yml b/.github/workflows/auto-merge-release.yml index 1eca900..ce6b309 100644 --- a/.github/workflows/auto-merge-release.yml +++ b/.github/workflows/auto-merge-release.yml @@ -22,6 +22,7 @@ jobs: merge: if: github.repository == 'jdx/demand' runs-on: ubuntu-latest + timeout-minutes: 10 permissions: contents: read steps: diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index c948323..e19852c 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -9,12 +9,19 @@ permissions: contents: write pull-requests: write +# Never cancel a release that is already running. +concurrency: + group: release-plz + cancel-in-progress: false + jobs: release-plz: runs-on: ubuntu-latest + timeout-minutes: 30 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: + persist-credentials: false fetch-depth: 0 - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - uses: release-plz/action@b8d6b54b02889ff2ae2bb82e8b57c3a8fc1683a5 # v0.5 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b75bc40..4e1243d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -3,17 +3,22 @@ on: branches: [main] pull_request: branches: [main] +permissions: + contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true jobs: test: runs-on: ${{ matrix.platform }} + timeout-minutes: 30 strategy: matrix: platform: [ubuntu-latest, macos-latest, windows-latest] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5 - run: cargo clippy -- -D warnings @@ -26,6 +31,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false - uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2.9 test-ci: diff --git a/hk.pkl b/hk.pkl index 45f9b96..620972a 100644 --- a/hk.pkl +++ b/hk.pkl @@ -13,14 +13,18 @@ local linters = new Mapping { effect = "write" } } - // lints GitHub Actions workflows (jdx/jactionlint, a maintained actionlint fork) + // lints GitHub Actions workflows (jdx/jactionlint) ["jactionlint"] { - glob = List(".github/workflows/*.yml", ".github/workflows/*.yaml") + glob = List(".github/workflows/*.yml", ".github/workflows/*.yaml", ".github/actions/**/action.yml", ".github/actions/**/action.yaml", ".github/dependabot.yml", ".github/dependabot.yaml") batch = true check = new CommandSpec { command = "jactionlint {{ files }}" effect = "read" } + fix = new CommandSpec { + command = "jactionlint --fix {{ files }}" + effect = "write" + } } } diff --git a/mise.lock b/mise.lock index 95331a1..3298c25 100644 --- a/mise.lock +++ b/mise.lock @@ -177,50 +177,50 @@ url = "https://github.com/jdx/hk/releases/download/v2.5.0/hk-x86_64-pc-windows-m signer = "sigstore-oidc:https://github.com/jdx/hk/.github/workflows/release.yml" [[tools.jactionlint]] -version = "1.8.2" +version = "2.0.2" backend = "github:jdx/jactionlint" specifiers = ["latest"] [tools.jactionlint."platforms.linux-arm64"] -checksum = "sha256:7d618749dbddd762a14bd491ea97bc4f6599626f830a11edc6c6522ead8bcd05" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338576" +checksum = "sha256:978a9f32cc4ed1d81b94563fc49643b8b3a48dcba4d1ea089d9ba05f7e17e7a7" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020784" provenance = "github-attestations" [tools.jactionlint."platforms.linux-arm64-musl"] -checksum = "sha256:7d618749dbddd762a14bd491ea97bc4f6599626f830a11edc6c6522ead8bcd05" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338576" +checksum = "sha256:978a9f32cc4ed1d81b94563fc49643b8b3a48dcba4d1ea089d9ba05f7e17e7a7" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020784" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64"] -checksum = "sha256:6533bd8047fc012a3f66238d84f65cacdac669da00b9f6cf042c1734c252bc93" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338580" +checksum = "sha256:026bce6d0ef196f5b22bf43acb1348d47c5d0a5ae61d6ec3bdba1229a823161b" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020780" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64-musl"] -checksum = "sha256:6533bd8047fc012a3f66238d84f65cacdac669da00b9f6cf042c1734c252bc93" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338580" +checksum = "sha256:026bce6d0ef196f5b22bf43acb1348d47c5d0a5ae61d6ec3bdba1229a823161b" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020780" provenance = "github-attestations" [tools.jactionlint."platforms.macos-arm64"] -checksum = "sha256:de9eb05af3cde409dc0b37fe2fd6a21b875a575374e7b26c02d45a7086645c28" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_darwin_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338605" +checksum = "sha256:1ad210bd21f4c70a81e0bffecc6d223daca8dd13e57fa6899787064f8b724c7c" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020734" provenance = "github-attestations" [tools.jactionlint."platforms.macos-x64"] -checksum = "sha256:42790b2565759b7f4a81696fb9034b2060f97f551d2ced54cf722c9de9abe6b2" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_darwin_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338604" +checksum = "sha256:03ccb52f3bf3c6b1b6358689a4d31e5f05d558b32c0b8edaeac7c452abe7fff4" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_darwin_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020732" provenance = "github-attestations" [tools.jactionlint."platforms.windows-x64"] -checksum = "sha256:fd7be539cd3276d5178f85ef140c1bb52395b1ec1f59b1585050e1be3b0b194b" -url = "https://github.com/jdx/jactionlint/releases/download/v1.8.2/jactionlint_1.8.2_windows_amd64.zip" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/611338616" +checksum = "sha256:988403508761b96fa506920b7db420e6e738247aade084f9b928f452340c8f8f" +url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_windows_amd64.zip" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020828" provenance = "github-attestations" [[tools.pkl]] diff --git a/mise.toml b/mise.toml index 48d2b98..3bc062f 100644 --- a/mise.toml +++ b/mise.toml @@ -4,7 +4,7 @@ cargo-release = "1" hk = { version = "latest", minimum_release_age = "0s" } cargo-binstall = "latest" pkl = "latest" -jactionlint = "latest" +jactionlint = { version = "latest", minimum_release_age = "0s" } [tasks.changelog] description = "Generate changelog" From d74ce182433231c7fea3eb3f3a73a73203ece6dc Mon Sep 17 00:00:00 2001 From: jdx <216188+jdx@users.noreply.github.com> Date: Sat, 10 Oct 2026 14:03:00 +0000 Subject: [PATCH 2/3] chore(ci): bump jactionlint to 2.1.0 and run its online checks in CI Pin jactionlint 2.1.0 exactly, set JACTIONLINT_ONLINE=1 on the CI lint step only, and fix what 2.1.0 reports. Co-Authored-By: Claude Sonnet 5.5 --- .github/jactionlint.yaml | 5 ++++ .github/workflows/release-plz.yml | 11 ++++---- .github/workflows/test.yml | 7 ++++- mise.lock | 46 +++++++++++++++---------------- mise.toml | 2 +- 5 files changed, 41 insertions(+), 30 deletions(-) create mode 100644 .github/jactionlint.yaml diff --git a/.github/jactionlint.yaml b/.github/jactionlint.yaml new file mode 100644 index 0000000..39c37cc --- /dev/null +++ b/.github/jactionlint.yaml @@ -0,0 +1,5 @@ +ignores: + - rule: stale-action-refs + uses: dtolnay/rust-toolchain + file: .github/workflows/release-plz.yml + reason: dtolnay/rust-toolchain publishes the toolchain as the `stable` branch and tags only specific Rust versions, so the stable head never has a tag; the pin is the current head of that branch diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml index e19852c..90e8160 100644 --- a/.github/workflows/release-plz.yml +++ b/.github/workflows/release-plz.yml @@ -5,9 +5,7 @@ on: branches: - main -permissions: - contents: write - pull-requests: write +permissions: {} # Never cancel a release that is already running. concurrency: @@ -18,13 +16,16 @@ jobs: release-plz: runs-on: ubuntu-latest timeout-minutes: 30 + permissions: + contents: write + pull-requests: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false fetch-depth: 0 - - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - - uses: release-plz/action@b8d6b54b02889ff2ae2bb82e8b57c3a8fc1683a5 # v0.5 + - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable + - uses: release-plz/action@b8d6b54b02889ff2ae2bb82e8b57c3a8fc1683a5 # v0.5.139 env: GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }} CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 4e1243d..60cd89f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -20,11 +20,16 @@ jobs: with: persist-credentials: false - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 - - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5 + - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0 - run: cargo clippy -- -D warnings - run: cargo fmt -- --check - run: cargo test --lib --tests + # Online checks (known-vulnerable actions, impostor commits, stale refs) run + # in CI only; locally: JACTIONLINT_ONLINE=1 hk check --all - run: hk check --all + env: + JACTIONLINT_ONLINE: 1 + GITHUB_TOKEN: ${{ github.token }} semver: runs-on: ubuntu-latest diff --git a/mise.lock b/mise.lock index 3298c25..65bfb1a 100644 --- a/mise.lock +++ b/mise.lock @@ -177,50 +177,50 @@ url = "https://github.com/jdx/hk/releases/download/v2.5.0/hk-x86_64-pc-windows-m signer = "sigstore-oidc:https://github.com/jdx/hk/.github/workflows/release.yml" [[tools.jactionlint]] -version = "2.0.2" +version = "2.1.0" backend = "github:jdx/jactionlint" -specifiers = ["latest"] +specifiers = ["2.1.0"] [tools.jactionlint."platforms.linux-arm64"] -checksum = "sha256:978a9f32cc4ed1d81b94563fc49643b8b3a48dcba4d1ea089d9ba05f7e17e7a7" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020784" +checksum = "sha256:ec0c6496d8a2f37b2ae2a1af0fbf98d58df1f7c98a27cf9fdd64c20ad317234b" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112146" provenance = "github-attestations" [tools.jactionlint."platforms.linux-arm64-musl"] -checksum = "sha256:978a9f32cc4ed1d81b94563fc49643b8b3a48dcba4d1ea089d9ba05f7e17e7a7" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020784" +checksum = "sha256:ec0c6496d8a2f37b2ae2a1af0fbf98d58df1f7c98a27cf9fdd64c20ad317234b" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112146" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64"] -checksum = "sha256:026bce6d0ef196f5b22bf43acb1348d47c5d0a5ae61d6ec3bdba1229a823161b" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020780" +checksum = "sha256:baebfc5792135438fb3bb5ea266c3bf2538a089753616f1988ef618e4c0c3cb1" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112089" provenance = "github-attestations" [tools.jactionlint."platforms.linux-x64-musl"] -checksum = "sha256:026bce6d0ef196f5b22bf43acb1348d47c5d0a5ae61d6ec3bdba1229a823161b" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_linux_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020780" +checksum = "sha256:baebfc5792135438fb3bb5ea266c3bf2538a089753616f1988ef618e4c0c3cb1" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_linux_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112089" provenance = "github-attestations" [tools.jactionlint."platforms.macos-arm64"] -checksum = "sha256:1ad210bd21f4c70a81e0bffecc6d223daca8dd13e57fa6899787064f8b724c7c" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_darwin_arm64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020734" +checksum = "sha256:3766a4b0890d3eb36fe58760289885712131c7974de4bc9fabb9a3faa599e931" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_darwin_arm64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628111988" provenance = "github-attestations" [tools.jactionlint."platforms.macos-x64"] -checksum = "sha256:03ccb52f3bf3c6b1b6358689a4d31e5f05d558b32c0b8edaeac7c452abe7fff4" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_darwin_amd64.tar.gz" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020732" +checksum = "sha256:a88f2be76def62dd4fd9aed38c81d0db4144763012128a89800be80b1ee82e89" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_darwin_amd64.tar.gz" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112083" provenance = "github-attestations" [tools.jactionlint."platforms.windows-x64"] -checksum = "sha256:988403508761b96fa506920b7db420e6e738247aade084f9b928f452340c8f8f" -url = "https://github.com/jdx/jactionlint/releases/download/v2.0.2/jactionlint_2.0.2_windows_amd64.zip" -url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/626020828" +checksum = "sha256:5925a118df6db8c5be418acb05bd815d3c14ca98d91a9ecba6156753b87d4ae7" +url = "https://github.com/jdx/jactionlint/releases/download/v2.1.0/jactionlint_2.1.0_windows_amd64.zip" +url_api = "https://api.github.com/repos/jdx/jactionlint/releases/assets/628112198" provenance = "github-attestations" [[tools.pkl]] diff --git a/mise.toml b/mise.toml index 3bc062f..6d4d202 100644 --- a/mise.toml +++ b/mise.toml @@ -4,7 +4,7 @@ cargo-release = "1" hk = { version = "latest", minimum_release_age = "0s" } cargo-binstall = "latest" pkl = "latest" -jactionlint = { version = "latest", minimum_release_age = "0s" } +jactionlint = "2.1.0" [tasks.changelog] description = "Generate changelog" From 61019c449b44c409432fe7226d8e078043c3dc2d Mon Sep 17 00:00:00 2001 From: jdx <216188+jdx@users.noreply.github.com> Date: Sat, 10 Oct 2026 14:07:51 +0000 Subject: [PATCH 3/3] chore(ci): track latest jactionlint, locked at 2.1.0 Co-Authored-By: Claude Sonnet 5.5 --- mise.lock | 5 ++++- mise.toml | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/mise.lock b/mise.lock index 65bfb1a..0fca89c 100644 --- a/mise.lock +++ b/mise.lock @@ -179,7 +179,10 @@ signer = "sigstore-oidc:https://github.com/jdx/hk/.github/workflows/release.yml" [[tools.jactionlint]] version = "2.1.0" backend = "github:jdx/jactionlint" -specifiers = ["2.1.0"] +specifiers = [ + "2.1.0", + "latest", +] [tools.jactionlint."platforms.linux-arm64"] checksum = "sha256:ec0c6496d8a2f37b2ae2a1af0fbf98d58df1f7c98a27cf9fdd64c20ad317234b" diff --git a/mise.toml b/mise.toml index 6d4d202..48d2b98 100644 --- a/mise.toml +++ b/mise.toml @@ -4,7 +4,7 @@ cargo-release = "1" hk = { version = "latest", minimum_release_age = "0s" } cargo-binstall = "latest" pkl = "latest" -jactionlint = "2.1.0" +jactionlint = "latest" [tasks.changelog] description = "Generate changelog"