Repository navigation
chore(ci): add GitHub Actions lockfile - #795
Merged
Merged
Conversation
✅ Deploy Preview for gitify ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
# Conflicts: # .github/workflows/lint.yml # .github/workflows/sonarcloud.yml # .github/workflows/test.yml # .github/workflows/zizmor.yml
|
afonsojramos
approved these changes
Nov 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a GitHub Actions lockfile generated with
gh actions-lock. Every action used by the workflows (direct and transitive) is recorded with its verified commit SHA in.github/workflows/actions.lock.actions/checkout@v7.0.1); the lockfile records the immutable SHA resolved for each ref.Notes
uses:withgh actions-lock.gh actions-lock --verify.Rollout considerations
gh actions-lockstores pins in the lockfile, so workflows move back to version tags. The org's current tooling still enforces inline SHA pinning:local>gitify-app/renovate-config→helpers:pinGitHubActionDigestsToSemver) will re-pin these refs on its next run.unpinned-usesaudit flags tag refs.githubactions:S7637flags tag refs.These tools do not understand lockfiles yet. Adopting this approach needs a policy decision: either relax those checks to
ref-pinand rely on the lockfile, or keep inline SHA pins and useactions.lockas an additional record of transitive dependencies (gh actions-lock --verifyaccepts that state).