Repository navigation
ci: lock dependency-review workflow action graph - #2460
Open
groupthinking wants to merge 2 commits into
Open
groupthinking wants to merge 2 commits into
groupthinking wants to merge 2 commits into
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
groupthinking
changed the title
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
groupthinking
changed the base branch from
main
to
fix/anthropic-sdk-v2-compat
October 22, 2026 23:47
groupthinking
force-pushed
the
test/actions-lock-dependency-review
branch
from
October 22, 2026 23:47
257b803 to
be94021
Compare
5 tasks done
groupthinking
marked this pull request as ready for review
October 23, 2026 00:03
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Lockfile-only updates are not recognized by dependency-change detection and would skip the dependency-review gate.
1 open issue
What changed in this PR
This PR pilots GitHub Actions dependency locking for EventRelay’s dependency-review workflow, adding recorded action commits and repository identities without changing its existing jobs or policies.
Changes:
- Adds a generated lockfile covering one workflow and three actions.
- Updates three action references to exact version tags backed by the lockfile.
- Preserves the security fixes inherited from merged PR #2456 and leaves separate gh-aw lock formats unchanged.
| File | Description |
|---|---|
.github/workflows/dependency-review.yml |
Uses exact action version tags matching the locked graph. |
.github/workflows/actions.lock |
Records action commits and owner/repository identities. |
Review effort: Balanced
Recognize the exact Actions lockfile path in the dependency-input detector. Exercise the workflow detector against real single-file Git diffs, including unrelated actions.lock names and the separate gh-aw lock format. Refs #2448; addresses review discussion_r4354819144.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Decision: TEST — lock the dependency-review workflow
The dependency-review workflow previously referenced movable
actions/checkout@v7andactions/dependency-review-action@v5tags and one SHA without a recorded repository identity. This PR onboards exactly that workflow into GitHub's public-preview action lockfile, preserving its jobs, permissions, triggers, advisory policy, license policy, and the separate gh-aw formats/exclusions. The dependency-input detector also recognizes Actions lockfile-only updates so they cannot skip review.Final head:
5cd469aac4b1f7ad031d9afe54e4292dc18170f5. Base:mainat verified security mergee93fd0e975cda0f3a59cb7fa812c19c64f6b2a52. PR #2456 is merged; GitHub automatically retargeted this pilot. The base tree is byte-identical to the previously tested security head9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b(08aca6db68446550ddd97987efb3f547e5603cf8). Final diff:.github/workflows/actions.lock; threeuses:changes and an exact Actions lockfile input in.github/workflows/dependency-review.yml; executable detector regressions intests/unit/test_dependency_review_workflow.py. The temporary pilot workflow was removed.Official change and applicability
GitHub
gh-actions-lock v0.3.0, published 2026-10-22, rejects fork-only/impostor pins and unanswered upstream checks that could previously pass. This is a supply-chain verification improvement; a lock does not prove upstream code is safe.Exact locked graph
The last action retains its original commit. Lockfile v0.0.3 records owner/repository IDs and contains one workflow and three dependencies.
Executed recipe and verification
Prerequisites: clean isolated checkout, GitHub CLI, official v0.3.0 binary, and authenticated public-upstream read access. The local shell has no GitHub credential. The executed alternative used a standard Ubuntu job in this public repository, scoped to this same-repository branch, with only
contents: readand the runner-issued token. No connector credential was exported. No paid runner, cache, artifact upload, AI API call, or billing change was added.560f07120dee5294da0af0f2aab8eec8b79de8b5; verify the checkout and keep this pilot separate from PR fix(security): guard AI SDKs and move to patched Pillow #2456.15810767a8cd28d389f0942e3ce515ac0008c3f65301c3834fd4c046d4bda497. Confirmactions-lock version v0.3.0.gh actions-lock --verify-local .github/workflows/dependency-review.yml # Baseline expected exit 1: three not-pinned. gh actions-lock --no-interactive .github/workflows/dependency-review.yml gh actions-lock --verify-local .github/workflows/dependency-review.yml gh actions-lock --verify .github/workflows/dependency-review.yml git diff --checkactions/checkout@v0.0.0-pilot-missing; local verification must exit 1. Restore the generated workflow and verify it passes again.usesworkflow content unchanged.VERIFIED: hosted generation, local coverage, online verification, missing-reference rejection, restoration, scoped file assertion, exact transfer hashes, and semantic preservation.
695ba95173d286db687279ab09579e57b4dc823d5b98598669d5dfb8e4f09a7a604a6da0d0db0a1a7b3802050b17c2461655d954cdeadd561ec26987590e37fb3b22687c2d4720495f1ac56c156b94ba3fd1b8faCurrent-head results are recorded below. The CLI and native-runner evidence remain separate. Repository/organization action-allowlist access is not available; do not weaken it. Documentation still differs on Enterprise-only versus Free/Team preview availability; this pilot records observed repository behavior.
Rollback, effort and opportunity
Before merge: close this draft. After an explicitly approved merge: revert the final two-file change through review and verify the original workflow. Do not discard unrelated work.
ESTIMATE: 15–30 minutes maintainer review after gates pass; not measured savings.
Possible deliverable: a supervised CI provenance audit for small software teams. Revenue and saved time remain hypotheses; no offer was marketed and no checkout was created.
This pilot remains unmerged. The prerequisite security PR #2456 has now merged with Hayden's specific approval. Exact-PR/head approval for #2460 remains required. No production deployment command was issued by this continuation.
Closes #2448
Stacked-branch review receipt — 2026-10-22
The initial final pilot head
257b803, based on main, proved native hosted lockfile use: run39873500586/job120153351284 explicitly logged Using locked action versions from the workflow's lockfile and downloaded all three recorded SHAs. Its dependency gate subsequently failed on main's old certifi. That historical failure was not bypassed.The canonical security continuation advanced PR #2456 to
9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b, including patched certifi/Pillow, the Python 3.11–3.12 contract, and an unmerged repository-wide addition of MIT-CMU and Unlicense to the accepted license list. Dependency Review passes on that head. Its predecessor's Python lanes passed 2,946 tests each. Approval of this policy change and exact-head merge authority are still maintainer responsibilities; no merge is authorized by this receipt.To avoid duplicating the fix, this pilot is now based on that exact existing security head. The lockfile bytes and all three action refs are unchanged from the official generated/online-verified graph. Only the selected workflow's three uses fields differ from the security base; its complete policy is inherited unchanged. The original workflow transfer hash above refers to the pre-rebase generated workflow.
Current head:
be9402169b0bcffe2c415f91805f90dbbfcc1373. Fresh current-head verification is complete; exact run evidence follows. Keep this PR draft. Merge PR #2456 only after exact approval and applicable gates, then retarget this pilot to repaired main, refresh/check it, and obtain its own exact-head approval. Do not merge this pilot into the security branch merely because it is the temporary PR base.Canonical receipt: Neon concept_tracker action149. No production deployment, merge, policy activation, or connector credential transfer.
Final verified pilot receipt
Head
be9402169b0bcffe2c415f91805f90dbbfcc1373, base9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b.VERIFIED implementation and scoped validation; draft/open/unmerged. No remaining implementation failure in this pilot. Prerequisite: exact approval and merge of PR #2456 (including its repository-wide license additions), then retarget #2460 to main, re-fetch/recheck the resulting head and obtain its separate approval. This receipt does not authorize either merge or production deployment.
Canonical receipt action149 retains source evidence, generated bytes/hashes, initial failures and recovery, exact mutations, review evidence, rejected Watch candidates and next action.
Continuation checkpoint — 2026-10-22 America/Chicago
e93fd0e975cda0f3a59cb7fa812c19c64f6b2a52, exact approved parent9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b; merged/base source trees match exactly.main; head and generated lock unchanged, two changed files. Existing generation and native-runner evidence remains attached to the same head/files, rather than being relabeled as a new test.gh-actions-lock --verify-local .github/workflows/dependency-review.yml,uv lock --check --offline,git diff --check 9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b HEAD, andsha256sum .github/workflows/actions.lock; command output confirms full selected-workflow coverage, 346 resolved packages, and original lock hash.Review repair — current head
5cd469aac4b1f7ad031d9afe54e4292dc18170f5Copilot discussion4354819144 identified a future lockfile-only bypass in the previous head. The previous green evidence covered the submitted YAML-changing diff, not future lock-only updates; any broad completion interpretation was too strong.
Added
.github/workflows/actions.lockto the exact-path detector and a real Git-diff regression. Before fix: 1 failed, 3 passed (changed=false/count=0for the lockfile). After fix: 4 passed on Python 3.11 and Python 3.12; unrelateddocs/actions.lockand the distinct gh-aw lock JSON remain excluded. Ruff, Black,git diff --check, and officialgh-actions-lock --verify-localpassed. The tested/published tree isf458c3d86d16eaf7410781abd5c2ba29eeb13872.The generated actions.lock bytes and graph are unchanged. Final scope is three files, with no license/advisory/permission change beyond the already merged security base. Fresh CI/review for 5cd469a is VERIFIED: all current-head required/relevant checks pass, the reported finding is fixed and resolved, and no unresolved threads remain. Older results are historical. No merge approval exists for this pilot.
Final current-head receipt — approval remains outstanding
Complete verified receipt. Current head
5cd469aac4b1f7ad031d9afe54e4292dc18170f5, base maine93fd0e975cda0f3a59cb7fa812c19c64f6b2a52, three-file diff, ready for review, mergeability clean. CI39876354795 PASS; both Python lanes 2,949 passed plus38 MCP tests. Dependency Review39876354816 PASS with native locked-action SHAs verified in raw logs. Coverage, Security, CodeQL, E2E, Secret Scan and metadata gates PASS; zero unresolved threads. Original generator online proof remains valid for the byte-identical lock graph; the new detector regression was separately executed and verified.Shortest repeat check in a clean checkout of this exact head, with Python3.11 or3.12 plus declared test dependencies and the verified official v0.3.0 CLI:
Expected:4 targeted tests pass; one workflow has complete lock coverage; lock and diff checks exit0. These checks were executed using the existing project Python3.11/3.12 environments and the official extension binary. Online generation/verification and negative-ref tests are the separately linked hosted run above. Revert through review after any future approved merge; do not hand-edit the lockfile.
NOT COMPLETE overall: the remaining required transition is an explicitly approved merge of this exact PR/head, followed by merge-artifact and post-merge checks. No production acceptance, live provider cost/latency, or savings claim is made.