Consume actions-lockfile v0.0.1 and fix goproxy wiring in CI - #32
Merged
Conversation
Pin the tagged github/actions-lockfile/go v0.0.1 instead of an untagged pseudo-version: goproxy.githubapp.com serves tagged private modules but returns a miss for bare commits, sending go to an unauthenticated direct git fetch that fails in CI. Rename File.Actions -> File.Dependencies to match the released API (on-disk yaml key 'dependencies' is unchanged) and name the concrete upgrade command for future-version lockfiles, which the detached parser no longer hardcodes. Add the github/setup-goproxy OIDC step to the go-test workflow so it can fetch the private module. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
✅ Ready to approve
The changes are small, cohesive, and match the stated intent; the only issues found are minor naming/doc-string consistency nits.
Note: this review does not count toward required approvals for merging.
Pull request overview
This PR updates gh-actions-pin to consume the released github/actions-lockfile/go v0.0.1 API and fixes CI module fetching by correctly wiring the GitHub goproxy + OIDC permissions at the job level.
Changes:
- Bump
github.com/github/actions-lockfile/gofrom a pseudo-version tov0.0.1and align code with the released API (File.Actions→File.Dependencies). - Improve future-lockfile-version handling by surfacing a concrete upgrade command in the error message.
- Fix
.github/workflows/test.ymlgoproxy setup by movingpermissionsunder the job and setting the Go proxy-related env vars.
File summaries
| File | Description |
|---|---|
| internal/lockfile/state.go | Aligns lockfile state handling with Dependencies field and improves error messaging for future lockfile versions. |
| internal/lockfile/state_test.go | Updates tests to use Dependencies field when validating persisted lockfile content. |
| internal/lockfile/state_marshal.go | Updates deterministic YAML emitter to serialize dependencies: from File.Dependencies. |
| go.mod | Pins github.com/github/actions-lockfile/go to v0.0.1. |
| go.sum | Updates module sums to match v0.0.1. |
| .github/workflows/test.yml | Corrects job-level permissions + env so CI uses authenticated goproxy resolution. |
Copilot's findings
- Files reviewed: 5/6 changed files
- Comments generated: 3
Note
Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
96
to
100
| // Normalize on-disk entries to the canonical (lowercased) pin form so any | ||
| // legacy mixed-case keys are rewritten on the next Save. | ||
| normalizedActions := make(map[string]parserlock.Action, len(file.Actions)) | ||
| for pinKey, action := range file.Actions { | ||
| normalizedActions := make(map[string]parserlock.Action, len(file.Dependencies)) | ||
| for pinKey, action := range file.Dependencies { | ||
| pin, ok := parserlock.ParsePin(pinKey) |
Comment on lines
+50
to
+52
| if len(file.Dependencies) > 0 { | ||
| keys := make([]string, 0, len(file.Dependencies)) | ||
| for k := range file.Dependencies { |
Comment on lines
+220
to
+221
| if _, ok := store2.file.Dependencies[sharedPin]; !ok { | ||
| t.Errorf("expected shared dep %s in actions, keys=%v", sharedPin, actionKeys(store2.file.Dependencies)) |
Address review nits: the local map var and the schema-field doc comments and a test failure message still said 'actions' after the field rename. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #30. Pins the tagged
github/actions-lockfile/go v0.0.1(goproxy serves tagged private modules but 404s bare pseudo-versions, so CI fell back to an unauthenticated direct git fetch), renamesFile.Actions→File.Dependenciesto match the released API (on-diskdependencies:key unchanged), and corrects thetest.ymlgoproxy setup — job-levelid-token: write+GOPROXYenv (the merged version hadpermissions:mis-nested underon:and no proxy env).