ci: pin external actions to commit SHAs and resolve own files at job.workflow_sha by javierdelapuente · Pull Request #1063 · canonical/operator-workflows

javierdelapuente · 2026-10-21T13:53:29Z

Applicable spec: N/A (pinning actions for reproducible builds)

Overview

Pins GitHub Actions references so that a pinned operator-workflows version determines the versions of everything it uses, except the integration test and publish pipeline (see below).

Rationale

Callers couldn't pin the workflows reproducibly because they referenced their own files at @main. job.workflow_repository / job.workflow_sha (replacing the deprecated canonical/get-workflow-version-action) let a reusable workflow resolve its own repository at the commit it was called with.

Workflow Changes

External actions are pinned to full commit SHAs with a version comment. Actions without releases are pinned to the current main SHA with a # main comment, and Renovate follows main: canonical/create-pull-request, canonical/action-tmate, canonical/documentation-style-guide, canonical/charm-logdump-action, charmed-kubernetes/actions-operator, apache/skywalking-eyes/header.
terraform_modules_compliance.yaml, docs_spread.yaml, test.yaml (licenserc download): use the workflow's own repository and commit instead of main.
integration_test.yaml: charmbuild is installed from job.workflow_repository at job.workflow_sha.
run_bot_pr_approval.yaml: uses the local ./ workflow reference.
renovate.json extends helpers:pinGitHubActionDigests; the README documents pinning, with a Renovate example for consumers.

Left at `@main` on purpose

The internal/* actions of the integration test and publish workflows: plan, build, plan-scan, plan-integration, get-plan, publish.

Pinning is possible by checking this repo out at job.workflow_sha and using the local action (verified in CI for plan, plan-scan, get-plan, publish).
It's not safe for build and plan-integration: they run in the project directory, so the checkout could be packed into the charm/rock and would change the rock cache key. GitHub also rejects local actions outside the workspace (../).
They share a contract (plan, artifact names, manifests) and must run the same version, so they stay together. Integration testing is superseded by charm-ci.

Validation

actionlint -shellcheck= -pyflakes=: only existing warnings, plus unknown job.workflow_sha / job.workflow_repository (documented GitHub contexts that actionlint's schema lacks).
workflow_test.yaml passes on this revision. Earlier failures were external flakes (Charmhub duplicate upload, snap download, gh-pages push race).

Checklist

The contributing guide was applied
The changelog is updated with user-relevant changes in the format of keep a changelog v1.1.0

Follow-up: pin operator-workflows in platform-engineering-charm-template (canonical/platform-engineering-charm-template#174).

@main

…workflow_sha - Pin external actions to SHAs; Renovate keeps them updated - terraform_modules_compliance, docs_spread, test (licenserc) and the charmbuild install use job.workflow_repository/job.workflow_sha instead of main - Leave the integration test and publish internal actions at @main (shared contract, build/plan-integration cannot be pinned safely) - Document pinning and Renovate in the README and changelog Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

Renovate needs an exception for this repository’s internal actions to preserve their intentional floating references and avoid recurring self-update PRs.

1 open issue

Exclude operator-workflows from digest pinning · New

What changed in this PR

This PR improves reproducibility for consumers of operator-workflows by pinning external actions and resolving shared files from the called workflow’s commit.

Changes:

Pin external actions to commit SHAs and enable Renovate digest updates.
Resolve shared scripts, configuration, and charmbuild using job.workflow_repository and job.workflow_sha.
Document pinning guidance and the intentional integration/publish exceptions.

File	Description
renovate.json	Enable automated action digest pinning.
README.md	Explain consumer pinning and exceptions.
docs/changelog.md	Record reproducibility changes.
.github/workflows/workflow_simple_test.yaml	Pin checkout and Node.js setup actions.
.github/workflows/test.yaml	Pin actions and resolve license configuration at the workflow commit.
.github/workflows/terraform_modules_test.yaml	Pin checkout and debugging actions.
.github/workflows/terraform_modules_release.yaml	Pin checkout actions.
.github/workflows/terraform_modules_compliance.yaml	Resolve the checker using workflow contexts and pin actions.
.github/workflows/run_bot_pr_approval.yaml	Use a same-commit local workflow reference.
.github/workflows/publish_charm.yaml	Pin external publishing actions.
.github/workflows/promote_charm.yaml	Pin checkout.
.github/workflows/pr_from_template_files.yaml	Pin checkout.
.github/workflows/integration_test.yaml	Pin external actions and install `charmbuild` at the workflow commit.
.github/workflows/integration_test_run.yaml	Pin environment, artifact, and debugging actions.
.github/workflows/generate_terraform_docs.yaml	Pin documentation and pull-request actions.
.github/workflows/docs.yaml	Pin linting, link-checking, and cache actions.
.github/workflows/docs_spread.yaml	Resolve the shared script at the workflow commit and pin actions.
.github/workflows/docs_rtd.yaml	Pin checkout.
.github/workflows/comment.yaml	Pin artifact-download and scripting actions.
.github/workflows/comment_contributing.yaml	Pin checkout and scripting actions.
.github/workflows/charmbuild_test.yaml	Pin checkout and Python setup actions.
.github/workflows/bot_pr_approval.yaml	Pin the scripting action.
.github/workflows/auto_update_charm_libs.yaml	Pin checkout and pull-request actions.
.github/workflows/allure_report.yaml	Pin checkout and artifact-download actions.

_{Review effort: Balanced}

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-10-22T13:07:12Z

Test results for commit `8fc9fdd`

Test coverage for 8fc9fdd

Name           Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------
src/charm.py       8      8      0      0     0%   8-25
----------------------------------------------------------
TOTAL              8      8      0      0     0%

Static code analysis report

Run started:2026-10-22 13:04:55.183640+00:00

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 56
  Total lines skipped (#nosec): 0
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

github-actions · 2026-10-22T13:07:13Z

Test results for commit `8fc9fdd`

Test coverage for 8fc9fdd

Name           Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------
src/charm.py       8      8      0      0     0%   8-25
----------------------------------------------------------
TOTAL              8      8      0      0     0%

Static code analysis report

Run started:2026-10-22 13:04:53.053105+00:00

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 56
  Total lines skipped (#nosec): 0
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

github-actions · 2026-10-22T13:07:14Z

Test results for commit `8fc9fdd`

Test coverage for 8fc9fdd

Name           Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------
src/charm.py       8      8      0      0     0%   8-25
----------------------------------------------------------
TOTAL              8      8      0      0     0%

Static code analysis report

Run started:2026-10-22 13:05:17.613708+00:00

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 56
  Total lines skipped (#nosec): 0
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

github-actions · 2026-10-22T13:07:31Z

Test results for commit `8fc9fdd`

Test coverage for 8fc9fdd

Name           Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------
src/charm.py       8      8      0      0     0%   8-25
----------------------------------------------------------
TOTAL              8      8      0      0     0%

Static code analysis report

Run started:2026-10-22 13:04:55.183640+00:00

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 56
  Total lines skipped (#nosec): 0
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

github-actions · 2026-10-22T13:07:32Z

Test results for commit `8fc9fdd`

Test coverage for 8fc9fdd

Name           Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------
src/charm.py       8      8      0      0     0%   8-25
----------------------------------------------------------
TOTAL              8      8      0      0     0%

Static code analysis report

Run started:2026-10-22 13:04:53.053105+00:00

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 56
  Total lines skipped (#nosec): 0
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

github-actions · 2026-10-22T13:07:33Z

Test results for commit `8fc9fdd`

Test coverage for 8fc9fdd

Name           Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------
src/charm.py       8      8      0      0     0%   8-25
----------------------------------------------------------
TOTAL              8      8      0      0     0%

Static code analysis report

Run started:2026-10-22 13:05:17.613708+00:00

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 56
  Total lines skipped (#nosec): 0
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

Copilot

🟢 Approval recommended

The reviewed pins and workflow-relative resource resolution have no identified blocking issues, and the Renovate exception addresses the prior feedback.

No open issues 🎉

1 resolved since last review

Exclude operator-workflows from digest pinning

_{Review effort: Balanced}

javierdelapuente force-pushed the pin-actions-to-shas branch from f90142a to 029f668 Compare October 22, 2026 09:22

javierdelapuente changed the title ~~ci: pin actions to commit SHAs and resolve own actions at job.workflow_sha~~ ci: pin external actions to commit SHAs and resolve own files at job.workflow_sha Oct 22, 2026

javierdelapuente mentioned this pull request Oct 22, 2026

Pin remaining workflow references to commit SHAs canonical/platform-engineering-charm-template#174

Merged

2 tasks done

javierdelapuente requested a balanced review from Copilot October 22, 2026 12:35

Copilot started reviewing on behalf of javierdelapuente October 22, 2026 12:36

View session

Copilot AI reviewed Oct 22, 2026

View reviewed changes

Comment thread renovate.json

Exclude operator-workflows internal actions from Renovate digest pinning

8fc9fdd

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

javierdelapuente requested a balanced review from Copilot October 22, 2026 13:08

javierdelapuente marked this pull request as ready for review October 22, 2026 13:09

javierdelapuente requested a review from a team as a code owner October 22, 2026 13:09

Copilot started reviewing on behalf of javierdelapuente October 22, 2026 13:09

View session

Copilot AI reviewed Oct 22, 2026

View reviewed changes

javierdelapuente marked this pull request as draft October 22, 2026 13:19

javierdelapuente marked this pull request as ready for review October 22, 2026 14:37

javierdelapuente requested a review from alithethird October 23, 2026 07:35

alithethird approved these changes Oct 23, 2026

View reviewed changes

alithethird merged commit 7147898 into main Oct 23, 2026
146 of 154 checks passed

alithethird deleted the pin-actions-to-shas branch October 23, 2026 07:53

Navigation Menu

Repository navigation

ci: pin external actions to commit SHAs and resolve own files at job.workflow_sha - #1063

ci: pin external actions to commit SHAs and resolve own files at job.workflow_sha#1063
alithethird merged 2 commits into
mainfrom
pin-actions-to-shas

javierdelapuente commented Oct 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

javierdelapuente commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Rationale

Workflow Changes

Left at @main on purpose

Validation

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

github-actions Bot commented Oct 22, 2026

Test results for commit 8fc9fdd

Uh oh!

github-actions Bot commented Oct 22, 2026

Test results for commit 8fc9fdd

Uh oh!

github-actions Bot commented Oct 22, 2026

Test results for commit 8fc9fdd

Uh oh!

github-actions Bot commented Oct 22, 2026

Test results for commit 8fc9fdd

Uh oh!

github-actions Bot commented Oct 22, 2026

Test results for commit 8fc9fdd

Uh oh!

github-actions Bot commented Oct 22, 2026

Test results for commit 8fc9fdd

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

javierdelapuente commented Oct 21, 2026 •

edited

Loading

Left at `@main` on purpose

Test results for commit `8fc9fdd`

Test results for commit `8fc9fdd`

Test results for commit `8fc9fdd`

Test results for commit `8fc9fdd`

Test results for commit `8fc9fdd`

Test results for commit `8fc9fdd`