uses

package

v0.3.0 Latest Latest Go to latest Published: Oct 22, 2026 License: MIT Imports: 2 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/github/gh-actions-lock

Links

Open Source Insights

Documentation ¶

Overview ¶

Package uses classifies `uses:` values, so every caller decides what a value is the same way and an unparseable reference can't be mistaken for one that is deliberately not a repository action.

Index ¶

type Error
- func (e *Error) Error() string
type Image
- func ClassifyImage(raw string) (Image, bool)
type ImageKind
type Kind
type Position
type Ref
- func Classify(raw string, pos Position) Ref
- func (r Ref) Err() error

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Error ¶

type Error struct {
	Raw     string
	Problem string
}

Error reports a `uses:` value the Actions backend rejects.

func (*Error) Error ¶

func (e *Error) Error() string

type Image ¶

type Image struct {
	// Name is the image reference without `docker://`, or the Dockerfile
	// path for ImageBuild.
	Name string
	Kind ImageKind
	// Where names the job, service, `$/` action or remote action using it.
	Where string
	// Action is the remote action (owner/repo[/path]@ref) that names the
	// image, so only its maintainer can pin it. Empty when the repository does.
	Action string
}

Image is a container image a workflow runs that the lockfile can't pin.

func ClassifyImage ¶

func ClassifyImage(raw string) (Image, bool)

ClassifyImage trims `docker://` from raw and returns the image it names, unless it's pinned by an `@sha256:` digest or empty.

type ImageKind ¶

type ImageKind int

ImageKind is how a container image is chosen when it isn't pinned by digest.

const (
	// ImageTag names an image by tag, or untagged (latest).
	ImageTag ImageKind = iota
	// ImageExpression is chosen at run time by a `${{ }}` expression.
	ImageExpression
	// ImageBuild is a Docker action's Dockerfile, built on the runner.
	ImageBuild
)

type Kind ¶

type Kind int

Kind is what a `uses:` value refers to.

const (
	// Empty is a blank value.
	Empty Kind = iota
	// Action is a remote repository action, in Ref.Action.
	Action
	// Local is a `./…` path in the same checkout.
	Local
	// Docker is a `docker://` image.
	Docker
	// Expression contains `${{ … }}` and is only known at run time.
	Expression
	// SelfRepository is a `$/…` reference to the defining repository.
	SelfRepository
	// ReusableWorkflow is a remote owner/repo/.github/workflows/x.yml@ref,
	// valid only at jobs.<job_id>.uses.
	ReusableWorkflow
	// Invalid is a value the Actions backend rejects; Ref.Problem says why.
	Invalid
)

type Position ¶

type Position int

Position is where a `uses:` value appears.

const (
	// Step is a workflow step or a composite action step.
	Step Position = iota
	// Job is jobs.<job_id>.uses.
	Job
)

type Ref ¶

type Ref struct {
	Kind Kind
	// Raw is the trimmed value.
	Raw string
	// Action is set when Kind is Action.
	Action parserlock.ActionRef
	// Problem, set when Kind is Invalid, completes "uses: <Raw> …".
	Problem string
}

Ref is a classified `uses:` value.

func Classify ¶

func Classify(raw string, pos Position) Ref

Classify classifies a `uses:` value found at pos.

func (Ref) Err ¶

func (r Ref) Err() error

Err is the error for an Invalid ref, nil otherwise.

Source Files ¶

View all Source files

uses.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL