Repository navigation
Test workflow dependency locking for the dependency-review workflow #2448
Description
Current state — verified pilot, merge approval outstanding
PR #2460 is ready at 5cd469aac4b1f7ad031d9afe54e4292dc18170f5, based on main security merge e93fd0e975cda0f3a59cb7fa812c19c64f6b2a52. Generation, online/local verification, negative tests, native hosted lockfile execution, and current-head checks are VERIFIED. The lockfile-only detector gap found during review is fixed with executed regressions. Final receipt; current complete recipe.
The original missing-CLI/authentication blocker is resolved. This issue remains open because pilot merging needs separate exact-PR/head approval. Overall delivery is NOT COMPLETE while that transition is outstanding. No extra automation has been created.
Historical original baseline and recipe — superseded by the current receipt
Decision: TEST — one-workflow dependency-lock pilot
Owner: groupthinking. Impact: CI dependency provenance/security. Urgency: planned maintenance, not an incident. Reversible: yes, isolated branch. Runtime adoption is NOT RUN.
Change and evidence
GitHub announced workflow dependency lockfiles on October 14, 2026, including Free and Team access in its corrected announcement. Instead of resolving a movable action tag each run, an onboarded workflow uses reviewed commits recorded with source repository identity and dependency information.
- Official announcement
- Setup documentation
- CLI v0.2.0, released October 12; tag resolved to
d5dca22a06ff8590d50b41612038996800cfb336. - Pinned README
- CLI installation pin option
Access caveat: the setup page still lists Enterprise Cloud while the later corrected announcement includes Free/Team. Confirm actual repository support during the pilot; this receipt does not claim hosted enforcement. GHES is unsupported. Locking does not certify that upstream code is safe.
Verified repository baseline
GitHub main was freshly fetched as 560f07120dee5294da0af0f2aab8eec8b79de8b5 on October 19. A read-only git show inventory at that exact commit found no .github/workflows/actions.lock.
dependency-review.yml contains exactly these three direct action references:
| Reference | Baseline |
|---|---|
| actions/checkout@v7 | Movable tag |
| advanced-security/component-detection-dependency-submission-action@b282c67 | Full SHA |
| actions/dependency-review-action@v5 | Movable tag |
Static assertions passed: three references, two tags, one SHA, no local-action reference, no workflow dependency lockfile. Worktree remained clean; exit 0. Whole-directory line-pattern inventory: 28 YAML workflows, 351 uses: occurrences, 296 SHA references and 55 tag/branch references. These counts are an inventory, not a recursive YAML/security audit.
Dependabot already has a github-actions ecosystem entry. Preserve its gh-aw exclusion. Existing generated *.lock.yml workflows and .github/aw/actions-lock.json are separate formats; do not regenerate or replace them in this pilot.
Complete execution recipe
Goal: onboard only dependency-review.yml while preserving its jobs, permissions, triggers and checks.
Prerequisites: Git, GitHub CLI, authenticated read access to this repository and upstream action repositories, network access for public release downloads/API resolution, and an isolated clean checkout. Publishing later requires repository write access. Review the extension release/source before execution. Check any Actions allowlist with an administrator: tag-only allowlist entries may need exact-SHA entries after onboarding. Do not weaken an allowlist automatically.
- Create a separate pinned checkout:
gh repo clone groupthinking/EventRelay eventrelay-actions-lock-pilot
cd eventrelay-actions-lock-pilot
git checkout -b test/actions-lock-dependency-review 560f07120dee5294da0af0f2aab8eec8b79de8b5
git status --porcelainExpected: clean working tree. Rebase deliberately if main has advanced; repeat the inventory against the new base.
- Install the reviewed version and check its reported version:
gh extension install github/gh-actions-lock --pin v0.2.0
gh actions-lock --version
gh actions-lock --verify-local .github/workflows/dependency-review.ymlExpected baseline: verification fails because the workflow is not onboarded. Capture actual output. If it passes, investigate changed behavior before proceeding.
- Generate and validate only the selected workflow:
gh actions-lock .github/workflows/dependency-review.yml
gh actions-lock --verify-local .github/workflows/dependency-review.yml
gh actions-lock --verify .github/workflows/dependency-review.yml
git diff --check
git diff --stat
git diff -- .github/workflows/dependency-review.yml
git status --shortExpected: scoped lockfile and workflow changes; both verification commands exit 0. Inspect the new actions.lock file separately because untracked files are absent from git diff. Review every resolved commit/repository identity, including discovered transitive dependencies. No hand-edited lockfile, bulk onboarding, relock or accept-moved shortcut.
-
Smallest negative test: in an isolated copy, change one selected workflow reference to a ref absent from its lockfile; scoped
--verify-localmust fail. Restore the workflow and confirm it passes. This tests missing-entry detection only; online--verifyis required for upstream identity/ref validation. -
Only after those checks, create one draft PR referencing this issue with the full diff and captured outputs. Confirm the hosted dependency-review job accepts the lockfile and required checks/reviews pass. Do not claim runner enforcement from an offline checker. Merge requires explicit approval for that PR/head under the Watch rule.
Cost, rollback, and status
The official CLI is MIT licensed; local inventory uses no paid API/model calls. The announcement includes Free/Team; repository plan, Actions allowances and any billed hosted minutes must be checked before a paid run. Do not enable AI Scan/agentic autofix or modify billing as part of this recipe.
ESTIMATE: 45–90 minutes for the scoped trial after prerequisites are available.
Rollback: before publication, discard only the isolated pilot checkout; before merge, close the pilot PR. After an authorized merge, revert its exact commit and verify the original workflow resumes. Preserve unrelated work.
VERIFIED: official release retrieval, exact-main inventory, scoped baseline assertions, duplicate search (no actions.lock issue/PR found), and clean working tree.
BLOCKED here: gh executable is unavailable; installation/generation/online verification/hosted enforcement are NOT RUN. No branch, lockfile, production deployment or merge was performed by this investigation.
Workflow opportunity: protect this security-review path against silent tag movement. A future reviewed CI provenance audit is a possible service deliverable for small software teams; revenue and time savings remain hypotheses.
Evidence ledger: concept_tracker observations262–264. Next queued action: supply the documented CLI execution prerequisites and run this bounded pilot; expand only after hosted evidence passes.
Activity
linear-code commentedon Oct 19, 2026
GRV-831
github-actions commentedon Oct 19, 2026
👋 Thanks for opening this issue! It has been automatically labeled for triage.
groupthinking commentedon Oct 22, 2026
Watch continuation ownership checkpoint (2026-10-22): automation
6ada9a7532088191aa2d608a07ab0b62is recorded in_progress, and its existing security checkout contains recent uncommitted Pillow/Python changes. This Watch run will leave PR #2456's working files untouched and take only #2448's isolated pilot in branchtest/actions-lock-dependency-review, based on main560f07120dee5294da0af0f2aab8eec8b79de8b5. Please re-fetch this issue/branch before another pilot edit. Official gh-actions-lock v0.3.0 release metadata was fetched; generation/testing are not yet claimed. No merge or production deployment authorized.groupthinking commentedon Oct 22, 2026
Pilot execution checkpoint — 2026-10-22
Advanced the existing bounded pilot without changing the repository:
gh-actions-lockv0.2.0 Linux AMD64 release.79ec84c191667fd935a277e6fd3662cf5d3669cccc9e99998731d8f306f373b6.actions-lock version v0.2.0.main560f07120dee5294da0af0f2aab8eec8b79de8b5.gh-actions-lock --verify-local .github/workflows/dependency-review.ymlexited 1 with
3 not-pinned, as expected.--no-interactive; the official CLI exited 2 before any write because no GitHub CLI authentication token is available in the execution environment.Exact blocker: the connected GitHub account is available only through the GitHub API connector; exporting or moving that credential into a shell CLI would violate the credential boundary. No workflow or lockfile was hand-edited, no branch was published, and hosted enforcement remains NOT RUN.
Resumable next command in an authenticated clean checkout:
gh actions-lock .github/workflows/dependency-review.ymlThen run scoped
--verify-local, online--verify, the missing-entry negative test, and open the draft PR only if all pass.groupthinking commentedon Oct 22, 2026
The missing-CLI-auth blocker is now resolved for this pilot using the official documented hosted route, without extracting connector credentials. Draft PR #2460 at
257b80380fd0bc19b82c1bdc77341f8238a380d2contains exactly the generated actions.lock and three selected workflow uses changes. Official v0.3.0 generation, local coverage, online pin validation, missing-ref negative test, restore and exact file hashes all passed in run https://github.com/groupthinking/EventRelay/actions/runs/39873356560 (job120152878586). The temporary generation workflow is removed. PR body contains the complete runnable recipe, SHA pins, rollback and limits. Current-head repository checks remain under inspection; native runner enforcement is not inferred merely from the CLI pass. Canonical execution receipt: concept_tracker action149. No merge or production deployment.groupthinking commentedon Oct 22, 2026
Pilot implemented and verified
Draft #2460 current head
be9402169b0bcffe2c415f91805f90dbbfcc1373is stacked on the existing security PR #2456 at9a76e5d64bfa9d37e002dba12ac27eb8d4c5fa9b. Exactly two files differ from that base; generated actions.lock bytes are unchanged, and only three uses fields differ in dependency-review.yml. The temporary runner workflow is absent.All current-head workflow checks completed successfully, with Dependabot auto-merge appropriately skipped. CI: https://github.com/groupthinking/EventRelay/actions/runs/39874097905 . Dependency Review: https://github.com/groupthinking/EventRelay/actions/runs/39874097927 . Job120155348866 explicitly confirms native locked versions and all three expected SHAs. Official v0.3.0 generation/local/online/negative/restore evidence remains at run39873356560; final local coverage and semantic checks passed.
This supersedes the CLI-auth blocker and main-based certifi failure snapshots. They remain retained as historical evidence. Complete recipe and receipt: #2460 and concept_tracker action149.
Next: review/approve exact security PR2456 head (including its repository-wide license additions), merge only under the standing expected-head gates, then retarget/recheck pilot2460 on repaired main and obtain separate approval. Neither PR was merged and no production deployment was performed.
fix(ci): review action lockfile-only dependency updates
groupthinking commentedon Oct 23, 2026
Current verified checkpoint — PR #2460 at 5cd469a
The prerequisite security PR #2456 merged as e93fd0e975cda0f3a59cb7fa812c19c64f6b2a52; all fresh post-merge push checks passed. Security receipt.
Pilot PR #2460 is ready for review against main, head
5cd469aac4b1f7ad031d9afe54e4292dc18170f5, treef458c3d86d16eaf7410781abd5c2ba29eeb13872. It remains unmerged.Exact implementation and repair
5b98598669d5dfb8e4f09a7a604a6da0d0db0a1a7b3802050b17c2461655d954. No hand-edited lock or gh-aw-format change.changed=false,count=0). After repair: 4/4 passed locally on both Python3.11 and3.12, including unrelated-path/gh-aw exclusions. Ruff, Black, diff and official local lock verification passed.Current-head verification
NOT COMPLETE overall: implementation/checks are verified, but PR2460 has no exact-head merge approval. Next required action: Hayden explicitly approves PR2460/head5cd469aac4b1f7ad031d9afe54e4292dc18170f5; then re-fetch head, applicable checks/reviews/threads/mergeability and use expected-head merge, followed by merge-commit/post-merge verification. No automatic merge, production deployment command, spending, outreach, or new timer was initiated for this pilot. Existing Vercel previews do not establish production acceptance.
Owner: groupthinking/Codex. Canonical ledger actions144/149, superseded auth blocker148, reviews339 and subsequent final pilot review. Full executable recipe, access/cost constraints, rollback and effort estimate remain in the PR body. Revenue/savings remain hypotheses.