From 6cdb68efe68dbd0244245b645122724f73f0bdfd Mon Sep 17 00:00:00 2001 From: lmdexpr Date: Thu, 1 Oct 2026 18:48:07 +0900 Subject: [PATCH 1/2] ci: build, test and OSV scan with setup-dune, locked with gh actions-lock Replace the opam-bootstrapped CI with ocaml-dune/setup-dune pinned to dune 3.24.2: build and test on Linux and macOS, and check formatting in the Linux test job (it already built the locked compiler @fmt needs). Scan dune.lock against OSV.dev with lmdexpr/dune-lock-osv on lock changes and daily; scheduled runs open/update an issue when vulnerabilities are found. All workflow dependencies, including transitive ones from composite actions, are locked with gh actions-lock (technical preview, v0.1.6). Dependabot is removed: bumping uses: refs alone would leave actions.lock stale. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/dependabot.yml | 6 --- .github/workflows/actions.lock | 47 +++++++++++++++++++ .github/workflows/ci.yml | 82 +++++++++++----------------------- .github/workflows/osv.yml | 31 +++++++++++++ 4 files changed, 103 insertions(+), 63 deletions(-) delete mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/actions.lock create mode 100644 .github/workflows/osv.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 3a626c3..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,6 +0,0 @@ -version: 2 -updates: - - package-ecosystem: github-actions - directory: / - schedule: - interval: monthly diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..e669197 --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,47 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.2' +workflows: + '.github/workflows/ci.yml': + - 'actions/checkout@v7.0.1' + - 'ocaml-dune/setup-dune@v2.1.0' + '.github/workflows/osv.yml': + - 'actions/checkout@v7.0.1' + - 'lmdexpr/dune-lock-osv@main' +dependencies: + 'actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7': + ref: 'v5.0.2' + commit: 'sha1-8b402f58fbc84540c8b491a91e594a4576fec3d7' + owner_id: 44036562 + repo_id: 215566462 + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3': + ref: 'v9.0.0' + commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3' + owner_id: 44036562 + repo_id: 205262760 + 'actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f': + ref: 'v6.0.0' + commit: 'sha1-b7c566a772e6b6bfb58ed0dc250532a479d7789f' + owner_id: 44036562 + repo_id: 192625955 + 'lmdexpr/dune-lock-osv@main': + ref: 'main' + commit: 'sha1-7f1568fa0114081c2e949c4b07e1c01386adeea5' + owner_id: 4951592 + repo_id: 1399418780 + uses: + - 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3' + 'ocaml-dune/setup-dune@v2.1.0': + ref: 'v2.1.0' + commit: 'sha1-2201fa80f49561672943e7960e5f918c887ab0dc' + owner_id: 62877882 + repo_id: 955896475 + uses: + - 'actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7' + - 'actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 21c63cb..3be793d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,73 +1,41 @@ +# This workflow is managed by gh actions-lock. + name: CI on: push: - branches: [main] + branches: [ main ] pull_request: + workflow_dispatch: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -jobs: - build: - runs-on: ubuntu-latest - - env: - # Persist dune's content-addressed build cache so that the locked - # dependencies (compiler included) are not rebuilt from source every run. - DUNE_CACHE: enabled - DUNE_CACHE_STORAGE_MODE: copy +permissions: + contents: read +jobs: + test: + strategy: + fail-fast: false + matrix: + # dune.lock is solved for linux and macos only + runs-on: [ ubuntu-latest, macos-latest ] + runs-on: ${{ matrix.runs-on }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - # Only the bootstrap `dune` binary lives in the opam switch; every project - # dependency is built hermetically from dune.lock/ by dune's package - # management, and ocamlformat is a dune tool. - - name: Install opam - run: | - sudo apt-get update - sudo apt-get install -y --no-install-recommends opam bubblewrap - - - name: Cache opam (dune bootstrap) - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 - with: - path: ~/.opam - key: opam-bootstrap-${{ runner.os }}-dune3.24 - - - name: Cache dune toolchain (OCaml compiler) - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + - uses: actions/checkout@v7.0.1 with: - path: ~/.cache/dune/toolchains - key: dune-toolchain-v1-${{ runner.os }}-${{ hashFiles('dune.lock/ocaml.*.pkg', 'dune.lock/ocaml-compiler.*.pkg', 'dune.lock/ocaml-base-compiler.*.pkg', 'dune.lock/ocaml-config.*.pkg') }} - - - name: Cache dune (build cache + git repos + _build) - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + persist-credentials: false + - uses: ocaml-dune/setup-dune@v2.1.0 with: - path: | - ~/.cache/dune/db - ~/.cache/dune/git-repo - _build - key: dune-cache-v1-${{ runner.os }}-${{ hashFiles('dune.lock/**') }} - restore-keys: | - dune-cache-v1-${{ runner.os }}- - - - name: Set up dune - run: | - opam init --disable-sandboxing -y - opam install dune -y - - - name: Build - run: opam exec -- dune build @all - + # Keep in sync with the local dune; nightly would make dune.lock churn + version: 3.24.2 + # Run here rather than in a separate job: @fmt needs the locked compiler + # this job already built, and a second job would race on the same cache key. - name: Check formatting + if: runner.os == 'Linux' run: | - opam exec -- dune tools install ocamlformat - opam exec -- dune build @fmt - - - name: Run tests - run: opam exec -- dune runtest - - - name: Trim dune build cache - run: opam exec -- dune cache trim --size 3GB + dune tools install ocamlformat + eval "$(dune tools env)" + dune build @fmt diff --git a/.github/workflows/osv.yml b/.github/workflows/osv.yml new file mode 100644 index 0000000..8713a6f --- /dev/null +++ b/.github/workflows/osv.yml @@ -0,0 +1,31 @@ +# This workflow is managed by gh actions-lock. + +name: OSV + +on: + push: + branches: [ main ] + paths: [ 'dune.lock/**', '.github/workflows/osv.yml', '.github/workflows/actions.lock' ] + pull_request: + paths: [ 'dune.lock/**', '.github/workflows/osv.yml', '.github/workflows/actions.lock' ] + schedule: + # New advisories land without any change on our side, so rescan daily. + - cron: '0 0 * * *' + workflow_dispatch: + +permissions: + contents: read + +jobs: + osv: + runs-on: ubuntu-latest + permissions: + contents: read + issues: write # only for create-issue on schedule + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - uses: lmdexpr/dune-lock-osv@main + with: + create-issue: ${{ github.event_name == 'schedule' }} From 2904990d0a7347fcf20d1b8962567ddbb1ecaad4 Mon Sep 17 00:00:00 2001 From: lmdexpr Date: Thu, 1 Oct 2026 18:48:13 +0900 Subject: [PATCH 2/2] chore(deps): bump sigv4 to lmdexpr/sigv4.ml@18b21b6 Pin sigv4 / sigv4-cohttp-eio to the merge of lmdexpr/sigv4.ml#1 (CI, OSV scan and dune.lock vulnerability fixes) in dune-project and the opam pin-depends, and relock with dune 3.24.2. Besides the pin, the relock bumps eio, eio_linux, eio_main and eio_posix 1.5 -> 1.6. Co-Authored-By: Claude Opus 5.5 (1M context) --- dune-project | 4 ++-- dune.lock/{eio.1.5.pkg => eio.1.6.pkg} | 6 +++--- .../{eio_linux.1.5.pkg => eio_linux.1.6.pkg} | 6 +++--- dune.lock/{eio_main.1.5.pkg => eio_main.1.6.pkg} | 6 +++--- dune.lock/eio_posix.1.5.pkg | 16 ---------------- dune.lock/eio_posix.1.6.pkg | 16 ++++++++++++++++ dune.lock/lock.dune | 2 +- dune.lock/sigv4-cohttp-eio.dev.pkg | 2 +- dune.lock/sigv4.dev.pkg | 2 +- dynamodb-cohttp-eio.opam | 4 ++-- dynamodb-cohttp-eio.opam.template | 4 ++-- 11 files changed, 34 insertions(+), 34 deletions(-) rename dune.lock/{eio.1.5.pkg => eio.1.6.pkg} (54%) rename dune.lock/{eio_linux.1.5.pkg => eio_linux.1.6.pkg} (64%) rename dune.lock/{eio_main.1.5.pkg => eio_main.1.6.pkg} (59%) delete mode 100644 dune.lock/eio_posix.1.5.pkg create mode 100644 dune.lock/eio_posix.1.6.pkg diff --git a/dune-project b/dune-project index 44ed9dd..71db92b 100644 --- a/dune-project +++ b/dune-project @@ -18,14 +18,14 @@ ;; sigv4 / sigv4-cohttp-eio are not yet published to the opam repository; pin them ; straight from the upstream repo. (pin (url - "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926") + "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda") (package (name sigv4) (version "dev"))) (pin (url - "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926") + "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda") (package (name sigv4-cohttp-eio) (version "dev"))) diff --git a/dune.lock/eio.1.5.pkg b/dune.lock/eio.1.6.pkg similarity index 54% rename from dune.lock/eio.1.5.pkg rename to dune.lock/eio.1.6.pkg index 55bffad..0b69a1f 100644 --- a/dune.lock/eio.1.5.pkg +++ b/dune.lock/eio.1.6.pkg @@ -1,4 +1,4 @@ -(version 1.5) +(version 1.6) (build (all_platforms @@ -21,6 +21,6 @@ (source (fetch (url - https://github.com/ocaml-multicore/eio/releases/download/v1.5/eio-1.5.tbz) + https://github.com/ocaml-multicore/eio/releases/download/v1.6/eio-1.6.tbz) (checksum - sha512=4582ac2fb2f8616b3d8ae9670eb7913a78085899b14044408801b30a34fed6c4d32971ba72eedb0cbc3d82c057610cf81c482090e75e2985330fcde96478ac5e))) + sha512=92ed8cf20300b8a4e0141bdbc373c0803c5a24530cb65852637d905fff4a5b956a8859a00a424034ff78c1112da9b0391194bcd558326168bdebd1ce683a8890))) diff --git a/dune.lock/eio_linux.1.5.pkg b/dune.lock/eio_linux.1.6.pkg similarity index 64% rename from dune.lock/eio_linux.1.5.pkg rename to dune.lock/eio_linux.1.6.pkg index ee75d19..93c24f6 100644 --- a/dune.lock/eio_linux.1.5.pkg +++ b/dune.lock/eio_linux.1.6.pkg @@ -1,4 +1,4 @@ -(version 1.5) +(version 1.6) (build (choice @@ -20,9 +20,9 @@ (source (fetch (url - https://github.com/ocaml-multicore/eio/releases/download/v1.5/eio-1.5.tbz) + https://github.com/ocaml-multicore/eio/releases/download/v1.6/eio-1.6.tbz) (checksum - sha512=4582ac2fb2f8616b3d8ae9670eb7913a78085899b14044408801b30a34fed6c4d32971ba72eedb0cbc3d82c057610cf81c482090e75e2985330fcde96478ac5e))) + sha512=92ed8cf20300b8a4e0141bdbc373c0803c5a24530cb65852637d905fff4a5b956a8859a00a424034ff78c1112da9b0391194bcd558326168bdebd1ce683a8890))) (enabled_on_platforms (only diff --git a/dune.lock/eio_main.1.5.pkg b/dune.lock/eio_main.1.6.pkg similarity index 59% rename from dune.lock/eio_main.1.5.pkg rename to dune.lock/eio_main.1.6.pkg index 68152f4..9e636ef 100644 --- a/dune.lock/eio_main.1.5.pkg +++ b/dune.lock/eio_main.1.6.pkg @@ -1,4 +1,4 @@ -(version 1.5) +(version 1.6) (build (all_platforms @@ -20,6 +20,6 @@ (source (fetch (url - https://github.com/ocaml-multicore/eio/releases/download/v1.5/eio-1.5.tbz) + https://github.com/ocaml-multicore/eio/releases/download/v1.6/eio-1.6.tbz) (checksum - sha512=4582ac2fb2f8616b3d8ae9670eb7913a78085899b14044408801b30a34fed6c4d32971ba72eedb0cbc3d82c057610cf81c482090e75e2985330fcde96478ac5e))) + sha512=92ed8cf20300b8a4e0141bdbc373c0803c5a24530cb65852637d905fff4a5b956a8859a00a424034ff78c1112da9b0391194bcd558326168bdebd1ce683a8890))) diff --git a/dune.lock/eio_posix.1.5.pkg b/dune.lock/eio_posix.1.5.pkg deleted file mode 100644 index e3d5ee2..0000000 --- a/dune.lock/eio_posix.1.5.pkg +++ /dev/null @@ -1,16 +0,0 @@ -(version 1.5) - -(build - (all_platforms - ((action (run dune build -p %{pkg-self:name} -j %{jobs} @install))))) - -(depends - (all_platforms - (dune eio iomux fmt))) - -(source - (fetch - (url - https://github.com/ocaml-multicore/eio/releases/download/v1.5/eio-1.5.tbz) - (checksum - sha512=4582ac2fb2f8616b3d8ae9670eb7913a78085899b14044408801b30a34fed6c4d32971ba72eedb0cbc3d82c057610cf81c482090e75e2985330fcde96478ac5e))) diff --git a/dune.lock/eio_posix.1.6.pkg b/dune.lock/eio_posix.1.6.pkg new file mode 100644 index 0000000..0cf0c04 --- /dev/null +++ b/dune.lock/eio_posix.1.6.pkg @@ -0,0 +1,16 @@ +(version 1.6) + +(build + (all_platforms + ((action (run dune build -p %{pkg-self:name} -j %{jobs} @install))))) + +(depends + (all_platforms + (dune eio iomux fmt))) + +(source + (fetch + (url + https://github.com/ocaml-multicore/eio/releases/download/v1.6/eio-1.6.tbz) + (checksum + sha512=92ed8cf20300b8a4e0141bdbc373c0803c5a24530cb65852637d905fff4a5b956a8859a00a424034ff78c1112da9b0391194bcd558326168bdebd1ce683a8890))) diff --git a/dune.lock/lock.dune b/dune.lock/lock.dune index 5196315..1bfa838 100644 --- a/dune.lock/lock.dune +++ b/dune.lock/lock.dune @@ -12,7 +12,7 @@ ((source https://github.com/ocaml-dune/opam-repository-relocatable.git#d64df82c7e16de819a770cabf4066a06243ed80b)) ((source - https://github.com/ocaml/opam-repository.git#275b0f5c38c9deb316b61205aa2f4995774f9360)))) + https://github.com/ocaml/opam-repository.git#6f927382c92d816a9b54225f9aeae9c52d0e5e10)))) (expanded_solver_variable_bindings (variable_values diff --git a/dune.lock/sigv4-cohttp-eio.dev.pkg b/dune.lock/sigv4-cohttp-eio.dev.pkg index e7f7f2b..a19d3bc 100644 --- a/dune.lock/sigv4-cohttp-eio.dev.pkg +++ b/dune.lock/sigv4-cohttp-eio.dev.pkg @@ -10,6 +10,6 @@ (source (fetch (url - git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926))) + git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda))) (dev) diff --git a/dune.lock/sigv4.dev.pkg b/dune.lock/sigv4.dev.pkg index 952cd70..54d1a5c 100644 --- a/dune.lock/sigv4.dev.pkg +++ b/dune.lock/sigv4.dev.pkg @@ -10,6 +10,6 @@ (source (fetch (url - git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926))) + git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda))) (dev) diff --git a/dynamodb-cohttp-eio.opam b/dynamodb-cohttp-eio.opam index 0ced8c6..0d29655 100644 --- a/dynamodb-cohttp-eio.opam +++ b/dynamodb-cohttp-eio.opam @@ -41,6 +41,6 @@ dev-repo: "git+https://github.com/lmdexpr/dynamodb.ml.git" x-maintenance-intent: ["(latest)"] # sigv4 is not on the opam repository yet. pin-depends: [ - ["sigv4.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926"] - ["sigv4-cohttp-eio.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926"] + ["sigv4.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda"] + ["sigv4-cohttp-eio.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda"] ] diff --git a/dynamodb-cohttp-eio.opam.template b/dynamodb-cohttp-eio.opam.template index a36d491..0ade140 100644 --- a/dynamodb-cohttp-eio.opam.template +++ b/dynamodb-cohttp-eio.opam.template @@ -1,5 +1,5 @@ # sigv4 is not on the opam repository yet. pin-depends: [ - ["sigv4.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926"] - ["sigv4-cohttp-eio.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#9a2e7247de94b9023e41f0217e8b9bc7eb14b926"] + ["sigv4.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda"] + ["sigv4-cohttp-eio.dev" "git+https://github.com/lmdexpr/sigv4.ml.git#18b21b67a2befebb5364718240d051f15fb7efda"] ]