mirror of
https://github.com/alibaba/open-code-review.git
synced 2026-08-21 14:44:56 +00:00
7e52a4fd55
Some checks are pending
CI / cross-compile (amd64, darwin) (push) Waiting to run
CI / cross-compile (amd64, windows) (push) Waiting to run
CI / cross-compile (arm64, darwin) (push) Waiting to run
CI / test (push) Waiting to run
Deploy Pages / build (push) Waiting to run
CI / cross-compile (arm64, linux) (push) Waiting to run
CI / cross-compile (arm64, windows) (push) Waiting to run
CodeQL Advanced / Analyze (actions) (push) Waiting to run
CodeQL Advanced / Analyze (go) (push) Waiting to run
CodeQL Advanced / Analyze (javascript-typescript) (push) Waiting to run
Deploy Pages / deploy (push) Blocked by required conditions
* fix(action): pin nested action references to full commit SHAs A consumer who SHA-pins alibaba/open-code-review still ran whatever the floating actions/* tags inside action.yml pointed at, so the outer pin did not actually freeze the workflow. Pin all four nested references to full commit SHAs with a trailing version comment, enforce the invariant with scripts/verify-action-pins.sh in CI, and document the dual pin (action SHA + ocr_version) that reproducible setups need. Refs #816 * fix(scripts): fail the pin check when action.yml is missing
46 lines
1.4 KiB
Bash
Executable file
46 lines
1.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
# Copyright 2026 alibaba/open-code-review Contributors
|
|
|
|
# Verify that every external action referenced by the published composite
|
|
# action (action.yml) is pinned to a full 40-hex commit SHA with a trailing
|
|
# "# vX.Y.Z" version comment. A floating tag inside action.yml silently
|
|
# undermines consumers who SHA-pin alibaba/open-code-review itself: the
|
|
# outer pin freezes this repository, but a moved inner tag still changes
|
|
# what actually runs (see issue #816).
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
|
|
files=("action.yml")
|
|
pinned='uses:[[:space:]]*[A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*v[0-9]'
|
|
local_ref='uses:[[:space:]]*\./'
|
|
|
|
bad=""
|
|
for file in "${files[@]}"; do
|
|
if [ ! -f "$file" ]; then
|
|
echo "ERROR: $file not found; the pin check cannot run." >&2
|
|
exit 1
|
|
fi
|
|
hits="$(grep -nE 'uses:' "$file" || true)"
|
|
[ -n "$hits" ] || continue
|
|
while IFS= read -r line; do
|
|
if printf '%s' "$line" | grep -qE "$local_ref"; then
|
|
continue
|
|
fi
|
|
if ! printf '%s' "$line" | grep -qE "$pinned"; then
|
|
bad="${bad}${file}:${line}"$'\n'
|
|
fi
|
|
done <<< "$hits"
|
|
done
|
|
|
|
if [ -n "$bad" ]; then
|
|
echo "The following action references are not pinned to a full commit SHA"
|
|
echo "with a '# vX.Y.Z' comment:"
|
|
printf '%s' "$bad"
|
|
echo "Pin them like: uses: owner/repo@<40-hex-sha> # vX.Y.Z"
|
|
exit 1
|
|
fi
|
|
|
|
echo "All external action references in ${files[*]} are SHA-pinned."
|