Skip to content

fix(governance): provide lock verifier to consumers #684

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 2 commits into from
Aug 29, 2026
+18 −2
Merged

fix(governance): provide lock verifier to consumers #684

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9c11ffa
fix(governance): provide lock verifier to consumers
hyperpolymath Aug 28, 2026
b6835b8
fix(governance): fail clearly when verifier is unavailable
hyperpolymath Aug 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 18 additions & 2 deletions .github/workflows/governance-reusable.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1048,7 +1048,9 @@ jobs:
repository: hyperpolymath/standards
ref: main
path: .standards-dupkey
sparse-checkout: scripts/check-workflow-duplicate-keys.sh
sparse-checkout: |
scripts/check-workflow-duplicate-keys.sh
scripts/update-actions-lock.sh
sparse-checkout-cone-mode: false
# ⚠ Not fatal if the file is absent. This checkout is pinned to
# standards@main, so during a rename of the script the fetch finds
Expand Down Expand Up @@ -1084,6 +1086,20 @@ jobs:
exit 1
fi
cp "$SCRIPT" "$RUNNER_TEMP/dupkeys.sh"
# The lockfile gate below runs in a consumer checkout, where the
# standards helper is not present. Preserve the canonical helper
# before removing this sparse standards checkout.
LOCK_SCRIPT=".standards-dupkey/scripts/update-actions-lock.sh"
if [ ! -f "$LOCK_SCRIPT" ] && [ -f scripts/update-actions-lock.sh ]; then
LOCK_SCRIPT="scripts/update-actions-lock.sh"
echo "Using this repository's own actions-lock verifier (standards self-lint)."
fi
if [ ! -f "$LOCK_SCRIPT" ]; then
echo "::error::actions-lock verifier not found — neither fetched from" \
"standards@main nor present locally."
exit 1
fi
cp "$LOCK_SCRIPT" "$RUNNER_TEMP/update-actions-lock.sh"
rm -rf .standards-dupkey
bash "$RUNNER_TEMP/dupkeys.sh" .github/workflows

Expand Down Expand Up @@ -1125,7 +1141,7 @@ jobs:
# external analysers and GitHub's sha_pinning_required setting do
# not infer direct pins from actions.lock.
gh extension install github/gh-actions-lock
bash scripts/update-actions-lock.sh --verify-local
bash "$RUNNER_TEMP/update-actions-lock.sh" --verify-local
unpinned=$(grep -rnE --include='*.yml' --include='*.yaml' \
"^[[:space:]]+uses:" .github/workflows/ | \
grep -v "@[a-f0-9]\{40\}" | \
Expand Down
Loading