diff --git a/.github/workflows/actions-lock.yml b/.github/workflows/actions-lock.yml new file mode 100644 index 0000000..daa03fe --- /dev/null +++ b/.github/workflows/actions-lock.yml @@ -0,0 +1,54 @@ +# Checks that .github/workflows/actions.lock pins every action the workflows +# use, directly or through other actions, to a commit that still verifies +# upstream. GitHub runs the locked commits, so a tag that's moved since can't +# change what runs. See +# https://docs.github.com/en/actions/concepts/security/workflow-dependency-lockfiles +# +# After changing a workflow's `uses:`, update the lockfile with +# gh extension install github/gh-actions-lock +# gh actions-lock +# and commit it with the change. If this check fails, its log ends with the +# patch that does that, which is also kept as the actions-lock-fix artifact. +name: actions-lock + +on: + push: + branches: + - main + # Into any branch, so that stacked pull requests are checked too. + pull_request: + # Catches a locked tag that's been moved upstream. + schedule: + - cron: '41 5 * * 1' + +permissions: + contents: read + +jobs: + verify: + name: Verify actions.lock + runs-on: ubuntu-latest + env: + GH_TOKEN: ${{ github.token }} + steps: + - uses: actions/checkout@v5.1.0 + with: + persist-credentials: false + - name: Install gh-actions-lock + run: gh extension install github/gh-actions-lock --pin v0.4.1 + - name: Verify + run: gh actions-lock --verify + - name: Show the fix + if: failure() + run: | + gh actions-lock || true + git add --intent-to-add .github/workflows/actions.lock || true + git diff > actions-lock-fix.patch + cat actions-lock-fix.patch + - name: Keep the fix + if: failure() + uses: actions/upload-artifact@v5.0.0 + with: + name: actions-lock-fix + path: actions-lock-fix.patch + if-no-files-found: ignore diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 0000000..cbfd88e --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,53 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/actions-lock.yml': + - 'actions/checkout@v5.1.0' + - 'actions/upload-artifact@v5.0.0' + '.github/workflows/ci.yml': + - 'actions/checkout@v5.1.0' + - 'actions/upload-artifact@v5.0.0' + - 'astral-sh/setup-uv@v10.2.0' + '.github/workflows/release.yml': + - 'actions/checkout@v5.1.0' + - 'actions/download-artifact@v5.0.0' + - 'actions/upload-artifact@v5.0.0' + - 'ruby/setup-ruby@v1.338.0' + '.github/workflows/screenshots.yml': + - 'actions/checkout@v5.1.0' + - 'actions/upload-artifact@v5.0.0' + '.github/workflows/testflight.yml': + - 'actions/checkout@v5.1.0' + - 'actions/upload-artifact@v5.0.0' + - 'ruby/setup-ruby@v1.338.0' + '.github/workflows/translations.yml': + - 'actions/checkout@v5.1.0' + - 'astral-sh/setup-uv@v10.2.0' +dependencies: + 'actions/checkout@v5.1.0': + ref: 'v5.1.0' + commit: 'sha1-fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09' + owner_id: 44036562 + repo_id: 197814629 + 'actions/download-artifact@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-634f93cb2916e3fdff6788551b99b062d0335ce0' + owner_id: 44036562 + repo_id: 192626254 + 'actions/upload-artifact@v5.0.0': + ref: 'v5.0.0' + commit: 'sha1-330a01c490aca151604b8cf639adc76d48f6c5d4' + owner_id: 44036562 + repo_id: 192625955 + 'astral-sh/setup-uv@v10.2.0': + ref: 'v10.2.0' + commit: 'sha1-c18668ad3cf93ea998bef934396af7bb5c839dc7' + owner_id: 115962839 + repo_id: 846733598 + 'ruby/setup-ruby@v1.338.0': + ref: 'v1.338.0' + commit: 'sha1-b3aaceaef7e0ee231b499e7b5f49c03fc1d32199' + owner_id: 210414 + repo_id: 231208785 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e5690f0..d2d6ad3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: # defaults to 27.0. DEVELOPER_DIR: /Applications/Xcode_27.1.app/Contents/Developer steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v5.1.0 - name: Show Xcode run: xcodebuild -version - name: Test ClementineKit @@ -32,7 +32,7 @@ jobs: name: Python runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v5.1.0 - uses: astral-sh/setup-uv@v10.2.0 - name: ruff check run: uv run ruff check --output-format github @@ -51,7 +51,7 @@ jobs: # defaults to 27.0. DEVELOPER_DIR: /Applications/Xcode_27.1.app/Contents/Developer steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v5.1.0 - name: Install XcodeGen run: brew install xcodegen - name: Check the Xcode project matches project.yml @@ -107,7 +107,7 @@ jobs: echo "::error::App/Resources/Localizable.xcstrings is out of date. Run scripts/build.sh and commit the catalog it updated, or take it from this run's String Catalog artifact." exit 1 fi - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@v5.0.0 if: failure() with: name: String Catalog diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cb4229c..8a5ffbe 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -45,7 +45,7 @@ jobs: commit: ${{ steps.plan.outputs.commit }} first: ${{ steps.plan.outputs.first }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v5.1.0 with: # All of main's history and tags: the notes and version come from them. fetch-depth: 0 @@ -72,7 +72,7 @@ jobs: echo "::notice::Nothing has changed since the last release, so there's nothing to release." fi - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@v5.0.0 if: steps.plan.outputs.release == 'true' with: name: release-notes @@ -117,7 +117,7 @@ jobs: FASTLANE_OPT_OUT_USAGE: "1" FASTLANE_HIDE_CHANGELOG: "1" steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v5.1.0 with: ref: ${{ needs.plan.outputs.commit }} @@ -135,14 +135,14 @@ jobs: - name: Build run: scripts/archive.sh "$NAME" "$BUILD" build/release - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@v5.0.0 with: name: release path: | build/release/ClementineRemote.ipa build/release/ClementineRemote.xcarchive/dSYMs/ - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@v1.338.0 with: ruby-version: "3.4" bundler-cache: true @@ -176,7 +176,7 @@ jobs: FASTLANE_OPT_OUT_USAGE: "1" FASTLANE_HIDE_CHANGELOG: "1" steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v5.1.0 with: ref: ${{ needs.plan.outputs.commit }} @@ -188,12 +188,12 @@ jobs: printf '%s\n' "$ASC_PRIVATE_KEY" > "$key" echo "ASC_KEY_PATH=$key" >> "$GITHUB_ENV" - - uses: actions/download-artifact@v5 + - uses: actions/download-artifact@v5.0.0 with: name: release-notes path: ${{ runner.temp }}/notes - - uses: actions/download-artifact@v5 + - uses: actions/download-artifact@v5.0.0 with: pattern: store-screenshots-* path: ${{ runner.temp }}/store-screenshots @@ -216,7 +216,7 @@ jobs: done ls -l "$out" - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@v1.338.0 with: ruby-version: "3.4" bundler-cache: true diff --git a/.github/workflows/screenshots.yml b/.github/workflows/screenshots.yml index 6f274c5..6e48fbc 100644 --- a/.github/workflows/screenshots.yml +++ b/.github/workflows/screenshots.yml @@ -96,7 +96,7 @@ jobs: # A step's condition can't read secrets, so this says whether the R2 token is set. HAS_R2_TOKEN: ${{ secrets.R2_ACCESS_KEY_ID != '' }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v5.1.0 with: ref: ${{ inputs.ref }} @@ -243,7 +243,7 @@ jobs: done exit $status - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@v5.0.0 if: always() with: name: ${{ inputs.artifact || 'screenshots' }} diff --git a/.github/workflows/testflight.yml b/.github/workflows/testflight.yml index 5f85a6f..3826ad8 100644 --- a/.github/workflows/testflight.yml +++ b/.github/workflows/testflight.yml @@ -52,7 +52,7 @@ jobs: # A step's condition can't read secrets, so this says whether the API key is set. HAS_ASC_KEY: ${{ secrets.ASC_KEY_ID != '' }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v5.1.0 with: # The build number comes from the number of commits, and the version from the tags. fetch-depth: 0 @@ -92,7 +92,7 @@ jobs: TESTING_FEATURES: "YES" run: scripts/archive.sh "${{ steps.version.outputs.name }}" "${{ steps.version.outputs.build }}" build/release - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@v5.0.0 if: env.HAS_ASC_KEY == 'true' with: name: testflight @@ -100,7 +100,7 @@ jobs: build/release/ClementineRemote.ipa build/release/ClementineRemote.xcarchive/dSYMs/ - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@v1.338.0 if: env.HAS_ASC_KEY == 'true' with: ruby-version: "3.4" diff --git a/.github/workflows/translations.yml b/.github/workflows/translations.yml index b6528df..bc7995d 100644 --- a/.github/workflows/translations.yml +++ b/.github/workflows/translations.yml @@ -47,7 +47,7 @@ jobs: env: TX_TOKEN: ${{ secrets.TX_TOKEN }} steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v5.1.0 - uses: astral-sh/setup-uv@v10.2.0 if: env.TX_TOKEN != '' - name: Pull the translations made since the last pull @@ -80,7 +80,7 @@ jobs: run: echo "::notice::The TX_TOKEN or TX_KEY secret isn't set, so no translations were pulled. See RELEASING.md." # Checked out with the deploy key, so the push below runs the other workflows on the new # commit (ci.yml, testflight.yml), as a push with the workflow's own token wouldn't. - - uses: actions/checkout@v5 + - uses: actions/checkout@v5.1.0 if: env.TX_TOKEN != '' && env.HAS_TX_KEY == 'true' with: ref: main