build(ci): pin the tools these workflows install at runtime - #100
Merged
Conversation
A tool installed with `pip install <name>` or `npm install -g <name>` resolves to whatever is newest at the moment the job runs. That is a dependency like any other -- it executes in CI, and in some repos it feeds a publish -- but it was outside the pinning survey, which only looked at package manifests. Each pin carries a `# renovate:` comment, so it is tracked rather than merely frozen. The custom manager in reqstool/.github picks them up and will raise the upgrades as ordinary PRs. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ⓘ Follow-up to the pinning sweep. The first survey only looked at package manifests and missed this whole class: tools installed at runtime inside a workflow.
What & Why
pip install <name>andnpm install -g <name>resolve to whatever is newest at the moment the job runs. That is a dependency like any other — it executes in CI, and in some repos it feeds a publish — so an unpinned one is exactly the risk pinning exists to remove.Each pin carries a
# renovate:comment, so it is tracked rather than merely frozen — the distinction that mattered for the Nisse pin Renovate silently skipped. The custom manager inreqstool/.githubpicks these up and will raise upgrades as ordinary PRs.Pinned to the current latest of each.
Author checklist
actionlintclean — the pre-existing shellcheck findings in these files are unchanged (verified before/after)# renovate:annotations verified to be discovered by the manager regexes