Repository navigation
feature request: look up a hash by version #83
Description
Activity
If you are in agreement with this feature, I am willing to submit a PR implementing it.
@lucasgonze I'm not sure what you're suggesting we implement here. Are you looking for a way to specify a specific version of a dependency, or to update the hash in a workflow for an existing pinned dependency?
Let's say you have this:
uses: DoozyX/clang-format-lint-action@9ea72631b74e61ce337d0839a90e76180e997283 # pin@v0.13and there exists a 0.14 with hash 1234567.
You issue this command:
node bin.js --update DoozyX/clang-format-lint-action@v0.14Then the yaml file changes to:
uses: DoozyX/clang-format-lint-action@1234567 # pin@v0.14As a simplification, the CLI might simply report on the hash at a given version, in order to save the work of looking up the tag on Github. So this command:
node bin.js --lookup DoozyX/clang-format-lint-action@v0.14Would return this in the shell:
1234567Thanks for the examples, it makes it much clearer.
What are the benefits of adding support for
node bin.js --update DoozyX/clang-format-lint-action@v0.14in addition to updating the YAML touses: DoozyX/clang-format-lint-action@v0.14then re-runningbin.js? This would look up the hash for the new version provided (or you could updatepin@v0.13topin@v0.14and re-runbin.jsand it would update the hash tooMy intention with this is to avoid modifying hashes apart from the one named in the parameter.
The reason I would want to only touch the one item is concern that other items might be iterated to a hash that hadn't been vetted, and this would reduce the security of pinning by hash to the same level as pinning by version.
Am I understanding this right?
Yep, that's how it would work today.
We currently have an
--allowflag to ignore specific actions from being pinned. Would adding an--onlyflag enable your use case?# Update a single action ./bin.js --only DoozyX/clang-format-lint-action # Or update everything by a user/org ./bin.js --only DoozyX/*This would pull the latest hash for the version specified in the
pin@maincomment. If you wanted to manually update the version that you're pinning to, you'd have to update the YAML file.--onlywould do the job.I also like the "everything by a user/org" idea, because it allows for very trusted orgs like actions/.
FYI: my PR for this feature is not yet ready, but I have submitted a couple other trivial features that became useful during development.
- added a commit that references this issue
on Jun 24, 2022 Slightly off-topic, but github's Dependabot can not update github actions pinned by SHA if there is an appropriately formatted comment. See https://github.blog/changelog/2022-10-31-dependabot-now-updates-comments-in-github-actions-workflows-referencing-action-versions/
I'm going to close this issue as both Dependabot and Renovate can now update actions by submitting PRs
Pinning by hash createst UI friction. With a tool like yarn a developer can use the CLI to look up the hash and upgrade the yaml in a terse command -
yarn upgrade foopackage@1.2.3. With pin-github-action the developer has to find the repo, look up the tag of the version they want, copy the hash, and paste the hash into their yaml.pin-github-action should either: