GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Lock GitHub Actions workflows by hugovk · Pull Request #161811 · python/cpython

Conversation

hugovk commented Nov 11, 2026

Copy link

Copy Markdown

Member

GitHub Actions now supports lockfiles for workflows.

See https://hugovk.dev/blog/2026/lock-github-actions/

Also update zizmor in prek to support lockfiles (I also updated the other hooks, they don't trigger any code changes).

It has a new finding about new $/ self-repository syntax, let's fix it:

  help[self-repository]: use GitHub's dedicated self-repository syntax
     --> .github/workflows/reusable-docs.yml:107:11
      |
  104 |     name: 'Check for removed HTML IDs'
      |     ---------------------------------- this job
  ...
  107 |     uses: ./.github/workflows/reusable-check-html-ids.yml
      |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
      |
      = note: audit confidence → High
      = note: this finding has an auto-fix

However, http://github.com/rhysd/actionlint doesn't yet support the $/ syntax (rhysd/actionlint#711), so ignore that in actionlint.

We're already ignoring it's lack of support for ubuntu-26.04* runners (rhysd/actionlint#682).

There are pending PRs, but the tool author isn't active, so we could consider this fork:
rhysd/actionlint#719 (comment). Perhaps when we need to add a third ignore...

Finally, zizmor also flags this:

  help[adhoc-packages]: ad-hoc installation of packages
    --> .github/workflows/new-bugs-announce-notifier.yml:21:14
     |
  21 |       - run: npm install mailgun.js form-data
     |         ---  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ installs a package outside of a lockfile
     |         |
     |         this step
     |
     = note: audit confidence → High

I added a temporary zizmor ignore on that, let's tackle that in a follow up with an npm lockfile or a Python stdlib version.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

maurycy reacted with heart emoji

All reactions

❤️ 1 reaction

hugovk added 4 commits

November 11, 2026 17:54


          Lock GitHub Actions workflows

37a3bf4


          Fix zizmor's help[self-repository]: use GitHub's dedicated self-repos…

7c11ec2

…itory syntax


          Temporarily ignore zizmor's adhoc-packages warning

970eaf3


          Bump prek hooks

d7a7f26

hugovk requested review from a team, DinoV, Yhg1s, hoodmane and pablogsal as code owners

November 11, 2026 16:30

hugovk added the infra CI, GitHub Actions, buildbots, Dependabot, etc. label

Nov 11, 2026

hugovk requested review from AA-Turner, JacobCoffee, StanFromIreland, ezio-melotti, itamaro and webknjaz as code owners

November 11, 2026 16:30

bedevere-app Bot added the awaiting core review label

Nov 11, 2026

StanFromIreland approved these changes

Nov 11, 2026

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Nov 11, 2026

StanFromIreland added skip issue skip news labels

Nov 11, 2026

ezio-melotti approved these changes

Nov 11, 2026

View reviewed changes

This was referenced Nov 12, 2026

Replace SHA-pinned Actions with tag refs and a GitHub workflow lockfile (actions.lock) DanielH2018/server#8014

Closed

Switch the setup composite action to $/ and lint it through a $/-to-./ actionlint wrapper DanielH2018/server#8013

Closed

geekjourneyx mentioned this pull request

Nov 12, 2026

[UPDATE] 2026-11-12 · 用 GitHub Actions 锁文件（gh actions-lock）先锁 md2wechat-skill 发布流程 geekjourneyx/agendum#145

Open

4 tasks

corey-cole mentioned this pull request

Nov 12, 2026

ci: lock GitHub Actions with actions.lock measly-java-learning/dcgm-exporter-lite#5

Merged

2 tasks done

Reviewers

ezio-melotti

ezio-melotti approved these changes

StanFromIreland

StanFromIreland approved these changes

Yhg1s

Awaiting requested review from Yhg1s

Yhg1s is a code owner

DinoV

Awaiting requested review from DinoV

DinoV is a code owner

pablogsal

Awaiting requested review from pablogsal

pablogsal is a code owner

hoodmane

Awaiting requested review from hoodmane

hoodmane is a code owner

JacobCoffee

Awaiting requested review from JacobCoffee

JacobCoffee is a code owner

AA-Turner

Awaiting requested review from AA-Turner

AA-Turner is a code owner

webknjaz

Awaiting requested review from webknjaz

webknjaz is a code owner

itamaro

Awaiting requested review from itamaro

itamaro is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

awaiting merge infra

CI, GitHub Actions, buildbots, Dependabot, etc.

skip issue skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.