[BUG] Start using pinned versions for internal GHA needs#15
Conversation
Signed-off-by: John McCall <john@overturemaps.org>
John McCall (lowlydba)
had a problem deploying
to
check-linked-issue-app
GitHub Actions
Failure
Signed-off-by: John McCall <john@overturemaps.org>
John McCall (lowlydba)
had a problem deploying
to
check-linked-issue-app
GitHub Actions
Failure
John McCall (lowlydba)
deleted the
14-bug-omf-pr-checks-not-accessible-to-other-repos
branch
There was a problem hiding this comment.
Pull request overview
Updates the “OMF PR Checks” required workflow to consume the shared OvertureMaps validation workflow/action via a versioned reference, avoiding reliance on a local path or @main.
Changes:
- Switch
validate-pr-titlefrom a local reusable workflow reference toOvertureMaps/workflows/...@v1. - Switch
check-linked-issuefrom a local composite action reference toOvertureMaps/workflows/...@v1.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| issues: write # to post PR-related issue comments | ||
| statuses: write # to update commit status checks | ||
| uses: ./.github/workflows/validate-pr-title.yml | ||
| uses: OvertureMaps/workflows/.github/workflows/validate-pr-title.yml@validate-pr-title-v1 # zizmor: ignore[unpinned-uses] |
There was a problem hiding this comment.
@v1 is still a floating ref (mutable tag) and won’t satisfy “pinned”/immutable action provenance checks. If the intent is deterministic + supply-chain safe runs, pin these uses: references to a commit SHA (or at least an immutable release tag like v1.0.0) and remove the zizmor: ignore[unpinned-uses] suppression once pinned.
| steps: | ||
| - name: Check for linked issue | ||
| uses: ./.github/actions/check-linked-issue | ||
| uses: OvertureMaps/workflows/.github/actions/check-linked-issue@check-linked-issue-v1 # zizmor: ignore[unpinned-uses] |
There was a problem hiding this comment.
This action reference uses @v1, which is a moving tag and not an immutable pin; it also suppresses zizmor’s unpinned-uses finding. Consider pinning to a specific commit SHA (or immutable v1.x.y tag) so PR checks don’t change unexpectedly and the suppression can be dropped.
| uses: OvertureMaps/workflows/.github/actions/check-linked-issue@check-linked-issue-v1 # zizmor: ignore[unpinned-uses] | |
| uses: OvertureMaps/workflows/.github/actions/check-linked-issue@<FULL_40_CHARACTER_COMMIT_SHA> |
This resolves the chicken-and-egg problem of using a main branch, while still giving us full control over versioning.