Documentation
¶
Index ¶
- Constants
- func RewriteWorkflow(root *os.Root, relPath string, updates []pin.Update) error
- type Resolver
- type Strategy
- func (s *Strategy) Discover(ctx context.Context, fsys scalibrfs.FS) ([]pin.Ref, error)
- func (s *Strategy) Ecosystem() string
- func (s *Strategy) IsPinned(ref pin.Ref) bool
- func (s *Strategy) Resolve(ctx context.Context, ref pin.Ref) (pinnedValue, versionTag string, err error)
- func (s *Strategy) ResolveUpdate(ctx context.Context, ref pin.Ref) (string, string, string, error)
- func (s *Strategy) Rewrite(root *os.Root, relPath string, updates []pin.Update) error
- func (s *Strategy) ShouldSkip(ref pin.Ref) (bool, string)
- func (s *Strategy) Verify(ctx context.Context, ref pin.Ref) (*pin.Verification, error)
- type Verifier
Constants ¶
const (
// Ecosystem is the ecosystem identifier for GitHub Actions.
Ecosystem = "github-actions"
)
Variables ¶
This section is empty.
Functions ¶
func RewriteWorkflow ¶
RewriteWorkflow applies pin updates to a single workflow file within the given root directory. It uses regex-based replacement to preserve YAML formatting, indentation, quotes, and unrelated comments.
The output format is Dependabot-compatible:
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Types ¶
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver resolves action references to commit SHAs and semver tags using the git protocol (ls-remote). This works with any git hosting provider and does not require a REST API token — credentials are sourced from the standard auth store for private repos only.
A single ls-remote call returns all refs, avoiding the N+1 API call pattern of REST-based resolution.
func NewResolver ¶
func NewResolver() *Resolver
NewResolver creates a Resolver that uses the git protocol for ref resolution.
func (*Resolver) ResolveSHA ¶
ResolveSHA resolves a Git ref (tag, branch, or SHA) to a full 40-character commit SHA by querying the remote via the git protocol.
func (*Resolver) ResolveTag ¶
ResolveTag finds the most specific semver tag pointing at the given commit SHA. It lists all refs via ls-remote (cached per repository) and returns the best match (e.g., v4.2.2 over v4.2 over v4).
type Strategy ¶
type Strategy struct {
// contains filtered or unexported fields
}
Strategy implements the pin.Strategy interface for GitHub Actions workflow dependencies. It discovers uses: references in:
- .github/workflows/*.yml — standard workflow files
- action.yml / action.yaml at repo root — if the repo IS a GitHub Action
- .github/actions/*/action.yml — local composite actions
- any action.yml / action.yaml in the repo tree — arbitrary composite actions
It resolves tags to commit SHAs via the git protocol, verifies commits for fork/imposter provenance via the GitHub REST API, and rewrites files with Dependabot-compatible SHA pins.
func NewStrategy ¶
NewStrategy creates a Strategy for GitHub Actions pinning. The resolver uses the git protocol (no API client needed). The verifier uses the GitHub REST API client for commit provenance checks — pass nil to skip verification capabilities.
func (*Strategy) Discover ¶
Discover implements pin.Strategy. It finds all files containing GitHub Actions uses: references — both workflow files and composite action manifests.
func (*Strategy) IsPinned ¶
IsPinned implements pin.Strategy. A GitHub Actions ref is pinned when its version is a 40-character hex commit SHA.
func (*Strategy) Resolve ¶
func (s *Strategy) Resolve(ctx context.Context, ref pin.Ref) (pinnedValue, versionTag string, err error)
Resolve implements pin.Strategy. It resolves a mutable tag/branch to a commit SHA and finds the most specific semver tag for the Dependabot comment.
func (*Strategy) ResolveUpdate ¶
ResolveUpdate implements pin.Strategy. It re-resolves an already-pinned ref to the latest SHA in its major version channel (e.g., v4 → latest v4.x.x).
func (*Strategy) Rewrite ¶
Rewrite implements pin.Strategy. It rewrites workflow/action YAML files with SHA pins.
func (*Strategy) ShouldSkip ¶
ShouldSkip implements pin.Strategy. GitHub Actions refs containing expression syntax (${{ ... }}) cannot be statically pinned and should be skipped.
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks commit provenance using the GitHub API to detect fork/imposter commits and unsigned commits.
func NewVerifier ¶
NewVerifier creates a Verifier using the provided GitHub API client.
func (*Verifier) Verify ¶
Verify checks whether a commit SHA is trustworthy in the given repository. It checks:
- Whether the commit is signed (GPG/SSH signature verified by GitHub).
- Whether the commit is reachable from the repository's default branch.
- Whether the commit might be a fork/imposter commit (fetchable from the shared object store but not belonging to any branch).
Source Files