Harden upstream sync and dispatch CI without a deploy key

Pin GitHub Actions to commit SHAs
2026-10-21 09:09:07 +00:00 · 2026-10-21 07:35:30 +00:00
3 changed files with 74 additions and 45 deletions
@@ -22,8 +22,8 @@ jobs:
  go:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - run: gofmt -l cmd lib | tee /dev/stderr | (! read -r)
@@ -35,23 +35,23 @@ jobs:
      # token carrying the workflow scope.
      - id: lint-version
        run: echo "version=$(cat hack/golangci-lint.version)" >> "$GITHUB_OUTPUT"
-      - uses: golangci/golangci-lint-action@v9
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: ${{ steps.lint-version.outputs.version }}

  security:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # Reachability-aware, so it only fails on vulnerabilities we actually call.
      # It installs its own Go, hence no setup-go step; go-version-input must be
      # cleared or it collides with go-version-file.
-      - uses: golang/govulncheck-action@v1.1.0
+      - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
        with:
          repo-checkout: false
          go-version-file: go.mod
          go-version-input: ""
-      - uses: aquasecurity/trivy-action@v0.36.0
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: fs
          scan-ref: .
@@ -64,9 +64,9 @@ jobs:
  image:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/build-push-action@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          push: false
@@ -74,7 +74,7 @@ jobs:
          tags: routingtabletowg:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max
-      - uses: aquasecurity/trivy-action@v0.36.0
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: routingtabletowg:ci
          format: table
@@ -15,11 +15,11 @@ jobs:
  image:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # Emulation for the RUN steps of the non-native platforms.
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -27,14 +27,14 @@ jobs:
      # The tag is v-less already, so {{version}} is the tag itself. major.minor and
      # major are skipped for prereleases by the action itself.
      - id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
-      - uses: docker/build-push-action@v7
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/arm/v7
@@ -48,7 +48,7 @@ jobs:
    runs-on: ubuntu-latest
    needs: image
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Create the GitHub release
@@ -1,11 +1,12 @@
 # The golangci-lint version lives in hack/golangci-lint.version, which Dependabot
 # cannot parse. This bumps it and opens a PR.
 #
-# Events caused by GITHUB_TOKEN start no workflows. AUTOMATION_SSH_KEY is an optional
-# repository secret holding the private half of a deploy key with write access; the
-# branch is pushed over SSH with it, so pushes to an open PR run ci.yaml. Opening the PR
-# is still a GITHUB_TOKEN event, so a new PR gets its checks from a dispatched run on
-# its branch, as workflow_dispatch is the exception to that rule.
+# The new golangci-lint runs in its own job without credentials. Only the job that
+# opens the PR can write.
+#
+# Events caused by GITHUB_TOKEN start no workflows, except workflow_dispatch. After
+# every push to the PR branch the PR job therefore dispatches ci.yaml on that branch;
+# the run attaches its checks to the PR head commit.
 name: upstream-sync

 on:
@@ -13,21 +14,25 @@ on:
    - cron: "17 4 * * *"
  workflow_dispatch:

-permissions:
-  contents: write
-  pull-requests: write
-  actions: write
-
-jobs:
-  golangci-lint:
-    runs-on: ubuntu-latest
-    concurrency:
+concurrency:
  group: upstream-sync-golangci-lint
  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    outputs:
+      changed: ${{ steps.detect.outputs.changed }}
+      current: ${{ steps.detect.outputs.current }}
+      latest: ${{ steps.detect.outputs.latest }}
+      result: ${{ steps.lint.outcome }}
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
-          ssh-key: ${{ secrets.AUTOMATION_SSH_KEY }}
+          persist-credentials: false

      - id: detect
        env:
@@ -36,40 +41,64 @@ jobs:
          set -euo pipefail
          current=$(cat hack/golangci-lint.version)
          latest=$(gh release view --repo golangci/golangci-lint --json tagName -q .tagName)
+          [[ "${latest}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
          echo "current=${current}" >> "$GITHUB_OUTPUT"
          echo "latest=${latest}" >> "$GITHUB_OUTPUT"
          [ "${current}" = "${latest}" ] && echo "changed=false" >> "$GITHUB_OUTPUT" || echo "changed=true" >> "$GITHUB_OUTPUT"

-      - if: steps.detect.outputs.changed == 'true'
-        run: echo "${{ steps.detect.outputs.latest }}" > hack/golangci-lint.version
-
      # A new release usually means new checks, so let the PR say whether we pass.
      - if: steps.detect.outputs.changed == 'true'
        id: lint
        continue-on-error: true
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          version: ${{ steps.detect.outputs.latest }}

-      - if: steps.detect.outputs.changed == 'true'
-        id: pr
-        uses: peter-evans/create-pull-request@v8
+  pull-request:
+    needs: lint
+    if: needs.lint.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - env:
+          LATEST: ${{ needs.lint.outputs.latest }}
+        run: echo "${LATEST}" > hack/golangci-lint.version
+
+      - id: pr
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          branch: automation/golangci-lint-version-sync
          delete-branch: true
-          commit-message: "Bump golangci-lint to ${{ steps.detect.outputs.latest }}"
-          title: "Bump golangci-lint to ${{ steps.detect.outputs.latest }}"
+          commit-message: "Bump golangci-lint to ${{ needs.lint.outputs.latest }}"
+          title: "Bump golangci-lint to ${{ needs.lint.outputs.latest }}"
          body: |
            Automated golangci-lint upstream sync.

-            - Previous: `${{ steps.detect.outputs.current }}`
-            - New: `${{ steps.detect.outputs.latest }}`
+            - Previous: `${{ needs.lint.outputs.current }}`
+            - New: `${{ needs.lint.outputs.latest }}`

-            Result of running the new version against the tree: `${{ steps.lint.outcome }}`.
+            Result of running the new version against the tree: `${{ needs.lint.outputs.result }}`.
            A failure here is expected when a release adds checks; the findings are in the
            job log of the run that opened this PR.

-      - if: steps.pr.outputs.pull-request-operation == 'created'
+      # A push or a new PR starts no CI, so dispatch it. An unchanged branch gets a run
+      # only when none exists for its head yet, which retries a lost dispatch.
+      - if: steps.pr.outputs.pull-request-number != ''
        env:
          GH_TOKEN: ${{ github.token }}
-        run: gh workflow run ci.yaml --ref automation/golangci-lint-version-sync
+          OPERATION: ${{ steps.pr.outputs.pull-request-operation }}
+          SHA: ${{ steps.pr.outputs.pull-request-head-sha }}
+          BRANCH: automation/golangci-lint-version-sync
+        run: |
+          set -euo pipefail
+          if [ "${OPERATION}" = none ] && [ "$(gh run list --workflow ci.yaml --commit "${SHA}" --json databaseId -q length)" != 0 ]; then
+            exit 0
+          fi
+          gh workflow run ci.yaml --ref "${BRANCH}"
Author	SHA1	Message	Date
Ruakij	d0f0e0e75d	Harden upstream sync and dispatch CI without a deploy key	2026-10-21 09:09:07 +00:00
Ruakij	3b6519f169	Pin GitHub Actions to commit SHAs	2026-10-21 07:35:30 +00:00