Follow-up to #4, split out at triage.
#4 pins every GitHub Actions uses: ref to an immutable commit SHA — in this repo's
.github/workflows/ci.yaml and in the three template workflows. That closes the supply-chain
hole, but it also means the pins never move again on their own: a SHA cannot pick up an
upstream security fix the way a floating @v4 tag silently does. Without an updater, #4 trades a
mutable-ref risk for a stale-dependency risk.
The usual answer is Dependabot's github-actions ecosystem (or Renovate), which opens a PR when a
pinned action releases a new version and rewrites both the SHA and the trailing # vX.Y.Z comment
that #4 establishes as the convention.
Two things to decide before this is buildable, which is why it is filed untriaged rather than
specced:
- Dependabot or Renovate, and whether the config also ships inside
template/ so every
generated project inherits an updater. Shipping it into the template means generated projects
get update PRs from day one; it also means every generated project gets a bot opening PRs,
which not every user will want — possibly a copier.yml question rather than an unconditional
file.
- Whether to also cover the
uv / Python ecosystems in the same config, or keep this ticket
strictly to github-actions so it stays one reviewable PR.
Depends-on: #4
Follow-up to #4, split out at triage.
#4 pins every GitHub Actions
uses:ref to an immutable commit SHA — in this repo's.github/workflows/ci.yamland in the three template workflows. That closes the supply-chainhole, but it also means the pins never move again on their own: a SHA cannot pick up an
upstream security fix the way a floating
@v4tag silently does. Without an updater, #4 trades amutable-ref risk for a stale-dependency risk.
The usual answer is Dependabot's
github-actionsecosystem (or Renovate), which opens a PR when apinned action releases a new version and rewrites both the SHA and the trailing
# vX.Y.Zcommentthat #4 establishes as the convention.
Two things to decide before this is buildable, which is why it is filed untriaged rather than
specced:
template/so everygenerated project inherits an updater. Shipping it into the template means generated projects
get update PRs from day one; it also means every generated project gets a bot opening PRs,
which not every user will want — possibly a
copier.ymlquestion rather than an unconditionalfile.
uv/ Python ecosystems in the same config, or keep this ticketstrictly to
github-actionsso it stays one reviewable PR.Depends-on: #4