fix(ci): validate and sync composite action pins against the actions registry#3367
fix(ci): validate and sync composite action pins against the actions registry#3367qubeena07 wants to merge 1 commit into
Conversation
…registry The two composite actions under .github/actions, contributor-check and ai-agent-runner, pin actions/setup-python and actions/setup-node directly and were never checked against .github/ci/actions.toml, so they had already drifted to older versions than the registry without anything catching it. This teaches scripts/ci/generate_workflows.py to also read those composite action files. Check now fails if a pinned action there does not match the registry entry for that same action name, and write rewrites just the uses line to match, leaving the rest of the file untouched. The ci generation check workflow now also runs on changes under .github/actions so this stays guarded going forward. Ran generate_workflows.py --write once to bring both files back in sync with the current registry, and added tests covering the new check and sync behavior. Fixes microsoft#3366
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
🤖 AI Agent: breaking-change-detector — API Compatibility
API CompatibilityNo breaking changes detected. |
🤖 AI Agent: docs-sync-checker — Docs Sync
Docs Sync
|
🤖 AI Agent: test-generator — `scripts/ci/generate_workflows.py`
|
🤖 AI Agent: code-reviewer — View details
TL;DR: 0 blockers, 0 warnings. The changes improve CI robustness by ensuring composite action pins are validated and synchronized with the actions registry.
No action required. Clean change. |
🤖 AI Agent: security-scanner — View details
No security issues found. |
PR Review Summary
Verdict: AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims. |
MohammadHaroonAbuomar
left a comment
MohammadHaroonAbuomar
left a comment
There was a problem hiding this comment.
- Sequencing: merge #3365 first, then rebase this and re-run scripts/ci/generate_workflows.py --write. Verified locally: clean git merge but real semantic conflict — this PR synced composite pins against main's current registry; #3365 moves setup-python to v6.3.0, so whichever merges second leaves main's ci-generation-check red (contributor-check/action.yml pinned to v6.2.0, registry expects v6.3.0). One --write re-run fixes it.
- (process) MAINTAINER: 15 action_required; approve runs. Check itself verified fail-closed empirically (drift -> exit 1).
Minor:
- setup-node v4.4.0->v6.4.0 in ai-agent-runner is a two-major registry-driven jump; node-version:22 is explicit so low risk, but worth a smoke run of that composite.
|
Hi @qubeena07, this PR has requested changes that are still open, with no update for a while. Could you address the review feedback when you have a chance? If there is no activity within one week we will close this to keep the review queue manageable, and you are welcome to reopen once you are ready. Thanks for the contribution. |
3 participants
Summary
Closes #3366.
The two composite actions under .github/actions, contributor-check and ai-agent-runner, pin actions/setup-python and actions/setup-node directly and were never checked against .github/ci/actions.toml. They had already drifted to older versions than the registry without anything catching it.
This teaches scripts/ci/generate_workflows.py to also read those composite action files. Check now fails if a pinned action there does not match the registry entry for that same action name, and write rewrites just the uses line to match the registry, leaving the rest of the file untouched. The ci generation check workflow now also runs on changes under .github/actions so this stays guarded going forward.
Ran generate_workflows.py --write once to bring both files back in sync with the current registry, and added tests covering the new check and sync behavior.
Test plan