fix(validators): refuse ./action refs inside workflow_call workflows - #123
Merged
Merged
Conversation
`./` in a called workflow resolves against the caller's workspace, never this repository's, so `uses: ./actions/x` in a `workflow_call` file fails at job setup for every cross-repository consumer. The existing exemption treated all `./` refs as local reusable *workflow* calls and let five of them ship across 0.1.21..0.1.23 -- breaking the ci-feedback path for three releases and the private security bundle for every real caller. Both were only caught by live failures. The check now distinguishes `./.github/workflows/*.yml` (a genuine same-repository reusable call, still exempt) from any other `./` path inside a reusable workflow, which it rejects with the fix to apply. Non-reusable workflows keep the exemption: their `./` resolves against their own checked out workspace. Signed-off-by: rldyourmnd <danil@nddev.it.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
./in a called workflow resolves against the caller's workspace, never this repository's.check_pinned_actions.pyexempted every./ref as "local reusable workflow", which let fiveuses: ./actions/...ship insideworkflow_callworkflows across 0.1.21..0.1.23 -- breakingci-feedback.ymlfor three releases (its job only fires on a failed conclusion, so the defect stayed silent) andprivate-security-bundle-free.ymlfor every cross-repository caller. Two live failures proved it:setup-systemsrun 35541466805 andgithub-device-syncrun 35541640707.Change
./.github/workflows/*.ymlstays exempt -- a genuine same-repository reusable call../path inside aworkflow_callworkflow is rejected, with the fix spelled out (name and pin the repository).workflow_callworkflows keep the exemption: their./resolves against their own checked-out workspace.Proof
check_pinned_actions: OKon the current tree (all five offenders were fixed in 0.1.24).workflow_callworkflow carryinguses: ./actions/tool-cacheis rejected at line precision, while./.github/workflows/actionlint.ymlbeside it stays legal.Signed-off-by: rldyourmnd danil@nddev.it.com