The workflow action pins only move when someone notices - #174
Merged
Conversation
Nothing bumped the seven workflows' action pins, so they only moved when someone noticed. Dependabot opens a weekly PR per pin, and the two required checks stand between it and master before auto-merge takes it. Only github-actions is enabled. Bumping the engine pin or a runtime Gradle dependency needs a device run, and no CI leg does one, so those stay manual. r0adkll/upload-google-play is ignored for the same reason: no PR runs play-publish.yml, so no check would validate the bump. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
GitHub counts a skipped check run as success for a required context, and neither required job can skip today. Once auto-merge arms unattended, adding a job-level if: to either would satisfy both contexts without building. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
The header came verbatim from xroche/httrack, where every pinned action also appears in a workflow that runs on a pull request under a required context. Here docker/build-push-action, docker/login-action and actions/download-artifact appear only in workflows no PR runs, so the inherited claim was false. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
The example named the release and docker workflows, but those also use actions/checkout and actions/upload-artifact, which native and assemble do run. actions/download-artifact is only in play-publish.yml, so it is a true example. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
github.actor is the event sender. On a synchronize that is whoever pushed, so a fork-side Dependabot push onto an attacker's PR satisfies the old guard, and GitHub's own examples use pull_request.user.login for this reason. The head-repo clause is what cannot be forged, since Dependabot pushes branches into the repo itself and never opens a PR from a fork. pull_request_target also reports the base branch as github.ref, so the old concurrency key put every PR in one group, where cancel-in-progress let any later PR event cancel an in-flight arming run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nothing bumps the action pins across the seven workflows here, so they move only when someone notices. Dependabot now opens a weekly PR per pin, and
dependabot-automerge.ymlarms auto-merge on it. The required "assemble (AGP 8)" and "native (ndk-build)" checks still gate that merge.The workflow is xroche/httrack's file of the same name, with the
github.repository ==guard repointed and its header comment rewritten. That comment claimed CI validates every pin dependabot bumps, which is not true here.docker/login-action,docker/build-push-actionandactions/download-artifactrun in no PR-triggered workflow at all.Only github-actions is enabled. A Gradle bump moves what ships in the APK. MirrorServerTest drives nanohttpd over a real socket under the required checks. No androidTest source set exists, so nothing exercises Custom Tabs or the app on a device. A submodule bump moves the engine, which needs the
versionNamerealignment and theAndroid.mksource-list check of a release round.r0adkll/upload-google-playis ignored for the same reason: no PR runsplay-publish.yml, so nothing validates that bump before it reaches the Play upload path. Dependabot security updates are disabled on this repo, so no advisory-driven PR opens today.The guard tests
github.event.pull_request.user.loginand the head repo, notgithub.actor.github.actoris the pusher, so a dependabot push onto a fork PR can satisfy it. The concurrency key is the PR number.pull_request_targetreports the base branch asgithub.ref, so one shared group lets any later PR cancel an in-flight arming run.android.ymlnow warns off a job-levelif:on the two required jobs. A skipped check run counts as success, so anif:there would let auto-merge land on a build that never ran.