From a0026f34c554cf18f4149aa44970a957ebd72b9d Mon Sep 17 00:00:00 2001 From: Jeff Martin Date: Sun, 14 Jun 2026 14:01:21 -0500 Subject: [PATCH 1/3] Rename gh-actions-pin to gh-actions-lock MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Renames the extension, binary, module path, CLI command, env vars, and all user-facing strings from actions-pin to actions-lock. The cmd/ directory moves from cmd/gh-actions-pin to cmd/gh-actions-lock. 90 files touched, zero functional changes — pure mechanical rename. --- .github/workflows/actions.lock | 4 +-- .github/workflows/release.yml | 2 +- .gitignore | 4 +-- Makefile | 6 ++-- README.md | 22 ++++++------ .../check.go | 34 +++++++++---------- .../check_json_golden_test.go | 6 ++-- .../command_test.go | 8 ++--- .../errors.go | 0 .../format/json.go | 2 +- .../format/json_test.go | 0 .../format/terminal.go | 14 ++++---- .../format/terminal_test.go | 14 ++++---- .../format/url.go | 0 .../format/url_test.go | 0 .../lockrecovery.go | 4 +-- .../lockrecovery_test.go | 2 +- .../main.go | 0 .../onboard_gate.go | 4 +-- .../pin_summary.go | 14 ++++---- .../pin_summary_test.go | 6 ++-- .../root.go | 26 +++++++------- .../root_test.go | 0 .../.github/workflows/actions.lock | 0 .../golden-json/.github/workflows/ci.yml | 0 .../testdata/golden-json/expected.json | 8 ++--- go.mod | 2 +- internal/config/config.go | 18 +++++----- internal/ghapi/client.go | 8 ++--- internal/ghapi/graphql_action_files.go | 2 +- internal/ghapi/graphql_peel.go | 2 +- internal/ghapi/graphql_peel_test.go | 2 +- internal/ghapi/graphql_reachability.go | 2 +- internal/ghapi/repos_dedup_test.go | 2 +- internal/ghapi/repos_test.go | 2 +- internal/lockfile/convertor.go | 2 +- internal/lockfile/direct_tracker.go | 2 +- internal/lockfile/state.go | 10 +++--- internal/lockfile/state_test.go | 10 +++--- internal/pin/commit.go | 8 ++--- internal/pin/plan.go | 14 ++++---- internal/pin/plan_test.go | 10 +++--- internal/pin/record.go | 4 +-- internal/pin/record_test.go | 2 +- internal/pin/retain_impostor_test.go | 8 ++--- internal/pinpool/pool.go | 6 ++-- internal/pinpool/pool_test.go | 10 +++--- internal/pipeline/checks/category.go | 2 +- internal/pipeline/checks/finding.go | 2 +- internal/pipeline/checks/impostor.go | 8 ++--- internal/pipeline/checks/impostor_test.go | 10 +++--- internal/pipeline/checks/misleading.go | 4 +-- internal/pipeline/checks/parsed.go | 2 +- internal/pipeline/checks/resolver.go | 6 ++-- internal/pipeline/checks/run.go | 4 +-- internal/pipeline/checks/run_test.go | 2 +- internal/pipeline/checks/structural.go | 8 ++--- internal/pipeline/diagnose.go | 14 ++++---- internal/pipeline/doc_urls.go | 2 +- internal/pipeline/finding_enrich.go | 6 ++-- internal/pipeline/impostor_parity_test.go | 8 ++--- internal/pipeline/parse.go | 14 ++++---- internal/pipeline/reach_findings.go | 8 ++--- internal/pipeline/reach_findings_test.go | 8 ++--- internal/pipeline/reach_partition.go | 8 ++--- internal/pipeline/resolver_test.go | 6 ++-- internal/pipeline/run.go | 14 ++++---- internal/pipeline/run_test.go | 4 +-- internal/resolve/ancestry.go | 2 +- internal/resolve/ancestry_test.go | 2 +- internal/resolve/cacheentry.go | 2 +- internal/resolve/discover_test.go | 6 ++-- internal/resolve/discovery.go | 6 ++-- internal/resolve/peel.go | 2 +- internal/resolve/peel_test.go | 2 +- internal/resolve/reachability.go | 6 ++-- internal/resolve/reachability_test.go | 4 +-- internal/resolve/resolver.go | 10 +++--- internal/resolve/resolver_test.go | 8 ++--- internal/resolve/reverse_lookup.go | 4 +-- internal/resolve/reverse_lookup_test.go | 8 ++--- internal/tag/tags.go | 4 +-- internal/tag/tags_keys_test.go | 2 +- internal/tag/tags_test.go | 2 +- internal/tag/testing.go | 4 +-- internal/ui/ui.go | 12 +++---- script/sync-early-access-release | 6 ++-- test/integration/harness.rb | 26 +++++++------- test/integration/run.rb | 8 ++--- test/scenarios/catalog.yml | 18 +++++----- 90 files changed, 295 insertions(+), 295 deletions(-) rename cmd/{gh-actions-pin => gh-actions-lock}/check.go (94%) rename cmd/{gh-actions-pin => gh-actions-lock}/check_json_golden_test.go (97%) rename cmd/{gh-actions-pin => gh-actions-lock}/command_test.go (99%) rename cmd/{gh-actions-pin => gh-actions-lock}/errors.go (100%) rename cmd/{gh-actions-pin => gh-actions-lock}/format/json.go (99%) rename cmd/{gh-actions-pin => gh-actions-lock}/format/json_test.go (100%) rename cmd/{gh-actions-pin => gh-actions-lock}/format/terminal.go (94%) rename cmd/{gh-actions-pin => gh-actions-lock}/format/terminal_test.go (96%) rename cmd/{gh-actions-pin => gh-actions-lock}/format/url.go (100%) rename cmd/{gh-actions-pin => gh-actions-lock}/format/url_test.go (100%) rename cmd/{gh-actions-pin => gh-actions-lock}/lockrecovery.go (96%) rename cmd/{gh-actions-pin => gh-actions-lock}/lockrecovery_test.go (98%) rename cmd/{gh-actions-pin => gh-actions-lock}/main.go (100%) rename cmd/{gh-actions-pin => gh-actions-lock}/onboard_gate.go (91%) rename cmd/{gh-actions-pin => gh-actions-lock}/pin_summary.go (97%) rename cmd/{gh-actions-pin => gh-actions-lock}/pin_summary_test.go (99%) rename cmd/{gh-actions-pin => gh-actions-lock}/root.go (91%) rename cmd/{gh-actions-pin => gh-actions-lock}/root_test.go (100%) rename cmd/{gh-actions-pin => gh-actions-lock}/testdata/golden-json/.github/workflows/actions.lock (100%) rename cmd/{gh-actions-pin => gh-actions-lock}/testdata/golden-json/.github/workflows/ci.yml (100%) rename cmd/{gh-actions-pin => gh-actions-lock}/testdata/golden-json/expected.json (93%) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 5864af4d..948b4b3b 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -1,5 +1,5 @@ -# This file is machine-generated by `gh actions-pin`. -# Do not edit by hand; run `gh actions-pin` to update. +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. # Docs: https://gh.io/actions-lockfile version: 'v0.0.1' workflows: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 372da01b..f66c6e17 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: with: generate_attestations: true go_version_file: go.mod - go_build_options: ./cmd/gh-actions-pin + go_build_options: ./cmd/gh-actions-lock sync-early-access-release: needs: release diff --git a/.gitignore b/.gitignore index 5abf4778..e4d3ce45 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,5 @@ -/gh-actions-pin -/gh-actions-pin.exe +/gh-actions-lock +/gh-actions-lock.exe # VHS demo recordings /demo/vhs/out/ diff --git a/Makefile b/Makefile index 9a1f082f..c1fc5afe 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ -BIN := gh-actions-pin -EXT_NAME := gh-actions-pin +BIN := gh-actions-lock +EXT_NAME := gh-actions-lock # Honor XDG_DATA_HOME so this matches where gh actually resolves its data # dir; fall back to the documented default when it's unset. XDG_DATA_HOME ?= $(HOME)/.local/share @@ -10,7 +10,7 @@ RUBY := $(shell command -v /opt/homebrew/opt/ruby/bin/ruby 2>/dev/null || echo r .PHONY: build test test-integration test-shell test-live test-matrix test-smoke test-stub test-real install reinstall uninstall build: - go build -o $(BIN) ./cmd/gh-actions-pin + go build -o $(BIN) ./cmd/gh-actions-lock test: go test ./... diff --git a/README.md b/README.md index 1a8116fd..d9cbb965 100644 --- a/README.md +++ b/README.md @@ -1,11 +1,11 @@ -# gh-actions-pin +# gh-actions-lock Manage your workflow dependencies. ## Install ```bash -gh extension install github/gh-actions-pin +gh extension install github/gh-actions-lock ``` ## Usage @@ -14,13 +14,13 @@ Scan every workflow under `.github/workflows/` and pin what it can -- pinning each resolvable action to an immutable SHA and updating the lockfile: ```bash -gh actions-pin +gh actions-lock ``` Scope the scan to a single workflow (same default behavior, one file): ```bash -gh actions-pin .github/workflows/ci.yml +gh actions-lock .github/workflows/ci.yml ``` By default, already-pinned workflows are trusted from the lockfile -- their @@ -28,13 +28,13 @@ reachability isn't re-checked against upstream. To force a full re-verification of every recorded pin (bypassing that fast path): ```bash -gh actions-pin --rescan +gh actions-lock --rescan ``` Read-only check for CI (reports findings, writes nothing): ```bash -gh actions-pin --no-fix --json=valid,findings +gh actions-lock --no-fix --json=valid,findings ``` `--no-fix` controls whether fixes are applied; `--json` only selects the output @@ -45,12 +45,12 @@ format. Structured results go to stdout, progress to stderr. GitHub Actions is a package manager that forgot to ship a lockfile. Your workflows are the manifest -- every `uses:` line is a dependency, resolved by mutable tag or branch *at runtime*, on GitHub's servers, with no record of what -actually ran. `gh-actions-pin` supplies the missing half: `.github/workflows/actions.lock`, +actually ran. `gh-actions-lock` supplies the missing half: `.github/workflows/actions.lock`, the Actions analogue of `go.sum` or `package-lock.json`. Each run resolves every direct and transitive dependency to an immutable commit SHA, locks it, and verifies the lock hasn't been tampered with before any of it runs. -A single `gh actions-pin` invocation walks two paths. The **verify** path is +A single `gh actions-lock` invocation walks two paths. The **verify** path is read-only and always runs: it scans every workflow, resolves each dependency to a commit SHA, and checks the result against the lockfile. The **fix** path applies pins — rewriting `uses:` lines and updating the lockfile — for the @@ -59,7 +59,7 @@ past in the spinner. ```mermaid flowchart TD - Start([gh actions-pin]) --> Scan + Start([gh actions-lock]) --> Scan subgraph verify["VERIFY · read-only diagnosis"] direction TB @@ -88,7 +88,7 @@ flowchart TD The security guarantee lives in **Verifying reachability**: a SHA pin is only trustworthy if that commit is reachable from the tag/branch it claims to come from. A SHA that resolves but isn't in the ref's history is an *impostor commit* --- the fork-network attack `gh-actions-pin` exists to catch -- and it's flagged +-- the fork-network attack `gh-actions-lock` exists to catch -- and it's flagged rather than silently trusted. ## Development @@ -114,6 +114,6 @@ sides pick them up. | Variable | Purpose | |---|---| | `GH_TOKEN` / `GITHUB_TOKEN` | Auth token for live tests (falls back to `gh auth token`) | -| `GH_ACTIONS_PIN_WORKFLOWS_DIR` | Override the workflows directory to scan (lab/testing use) | +| `GH_ACTIONS_LOCK_WORKFLOWS_DIR` | Override the workflows directory to scan (lab/testing use) | | `KEEP_FIXTURES` | Keep temp dirs after test runs for debugging | diff --git a/cmd/gh-actions-pin/check.go b/cmd/gh-actions-lock/check.go similarity index 94% rename from cmd/gh-actions-pin/check.go rename to cmd/gh-actions-lock/check.go index f33ad2be..6441c8b7 100644 --- a/cmd/gh-actions-pin/check.go +++ b/cmd/gh-actions-lock/check.go @@ -1,4 +1,4 @@ -// Command gh-actions-pin scans workflows and pins GitHub Actions to +// Command gh-actions-lock scans workflows and pins GitHub Actions to // immutable commit SHAs. package main @@ -14,16 +14,16 @@ import ( "github.com/MakeNowJust/heredoc" "github.com/cli/go-gh/v2/pkg/repository" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/cmd/gh-actions-pin/format" - "github.com/github/gh-actions-pin/internal/config" - "github.com/github/gh-actions-pin/internal/pin" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/pipeline" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/profile" - "github.com/github/gh-actions-pin/internal/resolve" - "github.com/github/gh-actions-pin/internal/tag" - "github.com/github/gh-actions-pin/internal/ui" + "github.com/github/gh-actions-lock/cmd/gh-actions-lock/format" + "github.com/github/gh-actions-lock/internal/config" + "github.com/github/gh-actions-lock/internal/pin" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/pipeline" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/profile" + "github.com/github/gh-actions-lock/internal/resolve" + "github.com/github/gh-actions-lock/internal/tag" + "github.com/github/gh-actions-lock/internal/ui" "github.com/spf13/cobra" ) @@ -70,7 +70,7 @@ func newCheckCmd(newResolver resolverFunc) *cobra.Command { --json selects the output format only — structured results on stdout, progress on stderr — and is independent of --no-fix: - gh actions-pin check --no-fix --json 2>/dev/null | jq .valid + gh actions-lock check --no-fix --json 2>/dev/null | jq .valid Issue types: ref-moved - locked SHA no longer matches upstream (expected for mutable tags like v4) @@ -95,16 +95,16 @@ func newCheckCmd(newResolver resolverFunc) *cobra.Command { `), Example: heredoc.Doc(` # Verify all workflows and fix what's fixable - $ gh actions-pin check + $ gh actions-lock check # Verify a specific workflow - $ gh actions-pin check .github/workflows/ci.yml + $ gh actions-lock check .github/workflows/ci.yml # Read-only check for CI (writes nothing, exits 1 if invalid) - $ gh actions-pin check --no-fix --json=valid,findings + $ gh actions-lock check --no-fix --json=valid,findings # All fields as JSON - $ gh actions-pin check --json + $ gh actions-lock check --json `), PreRunE: func(cmd *cobra.Command, args []string) error { if len(args) > 0 { @@ -469,7 +469,7 @@ func injectVersionRefFindings(report *checks.Report, record *pin.Record) { } } -// cliVersion returns the gh-actions-pin extension version embedded by the Go +// cliVersion returns the gh-actions-lock extension version embedded by the Go // build system. Returns "(devel)" for local `go build` and a real version // like "v0.1.2" when installed via `gh extension install`. func cliVersion() string { diff --git a/cmd/gh-actions-pin/check_json_golden_test.go b/cmd/gh-actions-lock/check_json_golden_test.go similarity index 97% rename from cmd/gh-actions-pin/check_json_golden_test.go rename to cmd/gh-actions-lock/check_json_golden_test.go index 4f7a41d4..408c56ad 100644 --- a/cmd/gh-actions-pin/check_json_golden_test.go +++ b/cmd/gh-actions-lock/check_json_golden_test.go @@ -1,6 +1,6 @@ package main -// Golden-file snapshot test for the `gh actions-pin check --json` contract. +// Golden-file snapshot test for the `gh actions-lock check --json` contract. // // We promised Dependabot the JSON shape is additive-only: no field renames, // no removals, no type shifts. New optional fields are allowed. This test @@ -8,7 +8,7 @@ package main // // To regenerate the golden after an intentional additive change: // -// UPDATE_GOLDEN=1 go test ./cmd/gh-actions-pin/ -run TestCheckCommand_JSONGolden +// UPDATE_GOLDEN=1 go test ./cmd/gh-actions-lock/ -run TestCheckCommand_JSONGolden // // CI runs without the env var, so any change to the JSON shape must be // intentional and committed alongside the code change. @@ -23,7 +23,7 @@ import ( "strings" "testing" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" "github.com/stretchr/testify/require" ) diff --git a/cmd/gh-actions-pin/command_test.go b/cmd/gh-actions-lock/command_test.go similarity index 99% rename from cmd/gh-actions-pin/command_test.go rename to cmd/gh-actions-lock/command_test.go index a16d4276..fcc30768 100644 --- a/cmd/gh-actions-pin/command_test.go +++ b/cmd/gh-actions-lock/command_test.go @@ -10,10 +10,10 @@ import ( "strings" "testing" - "github.com/github/gh-actions-pin/cmd/gh-actions-pin/format" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/cmd/gh-actions-lock/format" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/resolve" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) diff --git a/cmd/gh-actions-pin/errors.go b/cmd/gh-actions-lock/errors.go similarity index 100% rename from cmd/gh-actions-pin/errors.go rename to cmd/gh-actions-lock/errors.go diff --git a/cmd/gh-actions-pin/format/json.go b/cmd/gh-actions-lock/format/json.go similarity index 99% rename from cmd/gh-actions-pin/format/json.go rename to cmd/gh-actions-lock/format/json.go index 0c7bf2f4..04ebdc35 100644 --- a/cmd/gh-actions-pin/format/json.go +++ b/cmd/gh-actions-lock/format/json.go @@ -7,7 +7,7 @@ import ( "io" "strings" - "github.com/github/gh-actions-pin/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/pipeline/checks" ) // validJSONField reports whether name is a recognized --json output field. diff --git a/cmd/gh-actions-pin/format/json_test.go b/cmd/gh-actions-lock/format/json_test.go similarity index 100% rename from cmd/gh-actions-pin/format/json_test.go rename to cmd/gh-actions-lock/format/json_test.go diff --git a/cmd/gh-actions-pin/format/terminal.go b/cmd/gh-actions-lock/format/terminal.go similarity index 94% rename from cmd/gh-actions-pin/format/terminal.go rename to cmd/gh-actions-lock/format/terminal.go index 34e8b717..7a33c646 100644 --- a/cmd/gh-actions-pin/format/terminal.go +++ b/cmd/gh-actions-lock/format/terminal.go @@ -4,10 +4,10 @@ import ( "fmt" "strings" - "github.com/github/gh-actions-pin/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/pipeline" - "github.com/github/gh-actions-pin/internal/ui" + "github.com/github/gh-actions-lock/internal/pipeline" + "github.com/github/gh-actions-lock/internal/ui" ) // PresentResults renders human-readable output from a check report. @@ -200,8 +200,8 @@ func renderWarnings(out *ui.UI, report *checks.Report, willRemediate bool) { bareSHADeps = append(bareSHADeps, key) } case f.Category == checks.RefMoved: - // TODO: surface ref-moved warnings once the `gh actions-pin - // update` path exists. Today the guidance ("run gh actions-pin + // TODO: surface ref-moved warnings once the `gh actions-lock + // update` path exists. Today the guidance ("run gh actions-lock // to update") is wrong — a plain re-run trusts the lockfile and // repins nothing; only --rescan even detects the movement. Until // there's a command that actually advances a moved ref, swallow @@ -221,14 +221,14 @@ func renderWarnings(out *ui.UI, report *checks.Report, willRemediate bool) { if willRemediate { out.TermDetail("↳ resolving below") } else { - out.TermDetail("↳ run `gh actions-pin` to pin them") + out.TermDetail("↳ run `gh actions-lock` to pin them") } } if len(bareSHADeps) > 0 && !willRemediate { out.TermWarn("%d %s pinned to a bare SHA without a tag ref", len(bareSHADeps), ui.Pluralize(len(bareSHADeps), "action is", "actions are")) - out.TermDetail("↳ run `gh actions-pin` to pin to tagged releases") + out.TermDetail("↳ run `gh actions-lock` to pin to tagged releases") } for _, key := range otherDetailWarnings { wg := warnMap[key] diff --git a/cmd/gh-actions-pin/format/terminal_test.go b/cmd/gh-actions-lock/format/terminal_test.go similarity index 96% rename from cmd/gh-actions-pin/format/terminal_test.go rename to cmd/gh-actions-lock/format/terminal_test.go index 63f451f1..eeae2486 100644 --- a/cmd/gh-actions-pin/format/terminal_test.go +++ b/cmd/gh-actions-lock/format/terminal_test.go @@ -6,11 +6,11 @@ import ( "strings" "testing" - "github.com/github/gh-actions-pin/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/pipeline/checks" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ui" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ui" ) // newTestUI returns a UI whose narration log sinks to io.Discard, mirroring @@ -52,7 +52,7 @@ func TestPresentResults_WarningsReachTerminal(t *testing.T) { notWanted: []string{ "moved upstream", "compare/111111111111...222222222222", - "run `gh actions-pin` to update", + "run `gh actions-lock` to update", }, }, { @@ -176,7 +176,7 @@ func TestPresentResults_RemediateHints(t *testing.T) { Confidence: checks.ConfidenceHigh, }}, wantOutput: []string{"not yet pinned", "↳ resolving below"}, - notWanted: []string{"run `gh actions-pin`"}, + notWanted: []string{"run `gh actions-lock`"}, }, { name: "not-pinned shows manual hint when not remediating", @@ -187,7 +187,7 @@ func TestPresentResults_RemediateHints(t *testing.T) { Severity: checks.SeverityWarning, Confidence: checks.ConfidenceHigh, }}, - wantOutput: []string{"not yet pinned", "↳ run `gh actions-pin` to pin them"}, + wantOutput: []string{"not yet pinned", "↳ run `gh actions-lock` to pin them"}, notWanted: []string{"resolving below"}, }, { @@ -225,7 +225,7 @@ func TestPresentResults_RemediateHints(t *testing.T) { }}, notWanted: []string{ "moved upstream", - "run `gh actions-pin` to update", + "run `gh actions-lock` to update", }, }, { diff --git a/cmd/gh-actions-pin/format/url.go b/cmd/gh-actions-lock/format/url.go similarity index 100% rename from cmd/gh-actions-pin/format/url.go rename to cmd/gh-actions-lock/format/url.go diff --git a/cmd/gh-actions-pin/format/url_test.go b/cmd/gh-actions-lock/format/url_test.go similarity index 100% rename from cmd/gh-actions-pin/format/url_test.go rename to cmd/gh-actions-lock/format/url_test.go diff --git a/cmd/gh-actions-pin/lockrecovery.go b/cmd/gh-actions-lock/lockrecovery.go similarity index 96% rename from cmd/gh-actions-pin/lockrecovery.go rename to cmd/gh-actions-lock/lockrecovery.go index 26b9290d..08a08360 100644 --- a/cmd/gh-actions-pin/lockrecovery.go +++ b/cmd/gh-actions-lock/lockrecovery.go @@ -5,7 +5,7 @@ import ( "os" "github.com/cli/go-gh/v2/pkg/prompter" - "github.com/github/gh-actions-pin/internal/ui" + "github.com/github/gh-actions-lock/internal/ui" "github.com/spf13/cobra" "golang.org/x/term" ) @@ -67,7 +67,7 @@ type lockRecovery func(lockPath string, parseErr error) (recovered bool, err err func newLockRecovery(noInteractive bool, console *ui.UI, newConfirm confirmFactory, allowDelete bool) lockRecovery { return func(lockPath string, parseErr error) (bool, error) { if !allowDelete { - return false, fmt.Errorf("%w; run `gh actions-pin check` to rebuild it, or delete it by hand", parseErr) + return false, fmt.Errorf("%w; run `gh actions-lock check` to rebuild it, or delete it by hand", parseErr) } var ( confirm confirmer diff --git a/cmd/gh-actions-pin/lockrecovery_test.go b/cmd/gh-actions-lock/lockrecovery_test.go similarity index 98% rename from cmd/gh-actions-pin/lockrecovery_test.go rename to cmd/gh-actions-lock/lockrecovery_test.go index 69b60143..d3a0a1be 100644 --- a/cmd/gh-actions-pin/lockrecovery_test.go +++ b/cmd/gh-actions-lock/lockrecovery_test.go @@ -7,7 +7,7 @@ import ( "path/filepath" "testing" - "github.com/github/gh-actions-pin/internal/ui" + "github.com/github/gh-actions-lock/internal/ui" ) type fakeConfirmer struct { diff --git a/cmd/gh-actions-pin/main.go b/cmd/gh-actions-lock/main.go similarity index 100% rename from cmd/gh-actions-pin/main.go rename to cmd/gh-actions-lock/main.go diff --git a/cmd/gh-actions-pin/onboard_gate.go b/cmd/gh-actions-lock/onboard_gate.go similarity index 91% rename from cmd/gh-actions-pin/onboard_gate.go rename to cmd/gh-actions-lock/onboard_gate.go index aaeb0053..f0f59dc5 100644 --- a/cmd/gh-actions-pin/onboard_gate.go +++ b/cmd/gh-actions-lock/onboard_gate.go @@ -4,7 +4,7 @@ import ( "fmt" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/pipeline/checks" "github.com/spf13/cobra" ) @@ -33,7 +33,7 @@ func gateNoOnboard(report *checks.Report) []string { f.Category = checks.OnboardingRequired f.Severity = checks.SeverityInfo f.Detail = fmt.Sprintf("%s@%s has no lockfile entry; --no-onboard refuses to add new workflows or actions", ar.FullName(), ar.Ref) - f.Remediation = "onboard it first with `gh actions-pin check` (without --no-onboard)" + f.Remediation = "onboard it first with `gh actions-lock check` (without --no-onboard)" refused = append(refused, fmt.Sprintf("%s@%s in %s", ar.FullName(), ar.Ref, wr.Path)) } if len(refusedKeys) == 0 { diff --git a/cmd/gh-actions-pin/pin_summary.go b/cmd/gh-actions-lock/pin_summary.go similarity index 97% rename from cmd/gh-actions-pin/pin_summary.go rename to cmd/gh-actions-lock/pin_summary.go index 898a0ae0..99dbff70 100644 --- a/cmd/gh-actions-pin/pin_summary.go +++ b/cmd/gh-actions-lock/pin_summary.go @@ -5,12 +5,12 @@ import ( "strings" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/cmd/gh-actions-pin/format" - "github.com/github/gh-actions-pin/internal/pin" - "github.com/github/gh-actions-pin/internal/pipeline" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/resolve" - "github.com/github/gh-actions-pin/internal/ui" + "github.com/github/gh-actions-lock/cmd/gh-actions-lock/format" + "github.com/github/gh-actions-lock/internal/pin" + "github.com/github/gh-actions-lock/internal/pipeline" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/resolve" + "github.com/github/gh-actions-lock/internal/ui" ) // renderPinSummary prints the terminal summary after pin.Plan + pin.Commit. @@ -48,7 +48,7 @@ func renderPinSummary(console *ui.UI, record *pin.Record, report *checks.Report, if allClean && onboardingRefused == 0 && !hasInconclusive { console.TermSuccess("All %d %s valid", total, ui.Pluralize(total, "workflow", "workflows")) if skippedRescan > 0 { - console.TermDetail("Trusted lockfile for %d already-pinned %s; run `gh actions-pin --rescan` to re-verify reachability.", + console.TermDetail("Trusted lockfile for %d already-pinned %s; run `gh actions-lock --rescan` to re-verify reachability.", skippedRescan, ui.Pluralize(skippedRescan, "workflow", "workflows")) } return nil diff --git a/cmd/gh-actions-pin/pin_summary_test.go b/cmd/gh-actions-lock/pin_summary_test.go similarity index 99% rename from cmd/gh-actions-pin/pin_summary_test.go rename to cmd/gh-actions-lock/pin_summary_test.go index 7e382932..507f81ae 100644 --- a/cmd/gh-actions-pin/pin_summary_test.go +++ b/cmd/gh-actions-lock/pin_summary_test.go @@ -5,9 +5,9 @@ import ( "strings" "testing" - "github.com/github/gh-actions-pin/internal/pin" - "github.com/github/gh-actions-pin/internal/resolve" - "github.com/github/gh-actions-pin/internal/ui" + "github.com/github/gh-actions-lock/internal/pin" + "github.com/github/gh-actions-lock/internal/resolve" + "github.com/github/gh-actions-lock/internal/ui" ) // A workflow shared between two different actions must still be listed under diff --git a/cmd/gh-actions-pin/root.go b/cmd/gh-actions-lock/root.go similarity index 91% rename from cmd/gh-actions-pin/root.go rename to cmd/gh-actions-lock/root.go index a5f8cbe2..1e79ab22 100644 --- a/cmd/gh-actions-pin/root.go +++ b/cmd/gh-actions-lock/root.go @@ -13,11 +13,11 @@ import ( "github.com/MakeNowJust/heredoc" "github.com/cli/go-gh/v2/pkg/repository" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/lockfile" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/resolve" - "github.com/github/gh-actions-pin/internal/ui" - "github.com/github/gh-actions-pin/internal/workflowfile" + "github.com/github/gh-actions-lock/internal/lockfile" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/resolve" + "github.com/github/gh-actions-lock/internal/ui" + "github.com/github/gh-actions-lock/internal/workflowfile" "github.com/spf13/cobra" ) @@ -58,13 +58,13 @@ func execute() int { type resolverFunc func(hostname string, pool *pinpool.Pool) (*resolve.Resolver, error) -// newRootCmd returns the cobra command for the root `actions-pin` invocation. +// newRootCmd returns the cobra command for the root `actions-lock` invocation. // newResolver supplies the resolver builder; pass nil for production wiring. func newRootCmd(newResolver resolverFunc) *cobra.Command { opts := &checkOptions{} cmd := &cobra.Command{ - Use: "actions-pin [...]", + Use: "actions-lock [...]", Args: cobra.ArbitraryArgs, Short: "Lock and verify GitHub Actions dependencies", SilenceErrors: true, @@ -86,21 +86,21 @@ lockfile. Pass --no-fix for a read-only check that writes nothing. --json selects the output format only (independent of --no-fix); structured results go to stdout and progress to stderr: - gh actions-pin --no-fix --json 2>/dev/null | jq .valid + gh actions-lock --no-fix --json 2>/dev/null | jq .valid Commands: - gh actions-pin Verify and fix the dependency lock + gh actions-lock Verify and fix the dependency lock `), Example: heredoc.Doc(` # Verify all workflows and fix what's fixable -$ gh actions-pin +$ gh actions-lock # Verify a specific workflow -$ gh actions-pin .github/workflows/ci.yml +$ gh actions-lock .github/workflows/ci.yml # Read-only check for CI integration (writes nothing) -$ gh actions-pin --no-fix --json=valid,findings +$ gh actions-lock --no-fix --json=valid,findings `), PreRunE: func(cmd *cobra.Command, args []string) error { if len(args) > 0 { @@ -131,7 +131,7 @@ $ gh actions-pin --no-fix --json=valid,findings // from the existing lockfile so repeat scans short-circuit the per-branch // Compare walk. newResolver is the DI seam; pass nil for production wiring. func newRun(workflowPaths []string, hostname string, pool *pinpool.Pool, newResolver resolverFunc, onCorrupt lockRecovery) ([]string, *resolve.Resolver, *lockfile.State, error) { - workflowsDir := os.Getenv("GH_ACTIONS_PIN_WORKFLOWS_DIR") + workflowsDir := os.Getenv("GH_ACTIONS_LOCK_WORKFLOWS_DIR") paths, err := discoverWorkflowPaths(workflowPaths, workflowsDir) if err != nil { return nil, nil, nil, err diff --git a/cmd/gh-actions-pin/root_test.go b/cmd/gh-actions-lock/root_test.go similarity index 100% rename from cmd/gh-actions-pin/root_test.go rename to cmd/gh-actions-lock/root_test.go diff --git a/cmd/gh-actions-pin/testdata/golden-json/.github/workflows/actions.lock b/cmd/gh-actions-lock/testdata/golden-json/.github/workflows/actions.lock similarity index 100% rename from cmd/gh-actions-pin/testdata/golden-json/.github/workflows/actions.lock rename to cmd/gh-actions-lock/testdata/golden-json/.github/workflows/actions.lock diff --git a/cmd/gh-actions-pin/testdata/golden-json/.github/workflows/ci.yml b/cmd/gh-actions-lock/testdata/golden-json/.github/workflows/ci.yml similarity index 100% rename from cmd/gh-actions-pin/testdata/golden-json/.github/workflows/ci.yml rename to cmd/gh-actions-lock/testdata/golden-json/.github/workflows/ci.yml diff --git a/cmd/gh-actions-pin/testdata/golden-json/expected.json b/cmd/gh-actions-lock/testdata/golden-json/expected.json similarity index 93% rename from cmd/gh-actions-pin/testdata/golden-json/expected.json rename to cmd/gh-actions-lock/testdata/golden-json/expected.json index 0013f0c0..f6a8527b 100644 --- a/cmd/gh-actions-pin/testdata/golden-json/expected.json +++ b/cmd/gh-actions-lock/testdata/golden-json/expected.json @@ -47,7 +47,7 @@ "dependency": "actions/cache@v3", "detail": "workflow uses ref \"v3\" but lockfile pins \"v4\"", "doc_url": "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions", - "remediation": "re-run `gh actions-pin` to refresh the lockfile, or revert the uses: line", + "remediation": "re-run `gh actions-lock` to refresh the lockfile, or revert the uses: line", "severity": "error", "workflow": ".github/workflows/ci.yml" }, @@ -57,7 +57,7 @@ "dependency": "old/dead@v1", "detail": "lockfile pins old/dead@v1 but no uses: in this workflow references it", "doc_url": "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions", - "remediation": "remove the entry or re-run `gh actions-pin`", + "remediation": "remove the entry or re-run `gh actions-lock`", "severity": "warning", "workflow": ".github/workflows/ci.yml" } @@ -113,7 +113,7 @@ "dependency": "actions/cache@v3", "detail": "workflow uses ref \"v3\" but lockfile pins \"v4\"", "doc_url": "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions", - "remediation": "re-run `gh actions-pin` to refresh the lockfile, or revert the uses: line", + "remediation": "re-run `gh actions-lock` to refresh the lockfile, or revert the uses: line", "severity": "error", "workflow": ".github/workflows/ci.yml" }, @@ -123,7 +123,7 @@ "dependency": "old/dead@v1", "detail": "lockfile pins old/dead@v1 but no uses: in this workflow references it", "doc_url": "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions", - "remediation": "remove the entry or re-run `gh actions-pin`", + "remediation": "remove the entry or re-run `gh actions-lock`", "severity": "warning", "workflow": ".github/workflows/ci.yml" } diff --git a/go.mod b/go.mod index 4eb9730a..939e39e9 100644 --- a/go.mod +++ b/go.mod @@ -1,4 +1,4 @@ -module github.com/github/gh-actions-pin +module github.com/github/gh-actions-lock go 1.25.8 diff --git a/internal/config/config.go b/internal/config/config.go index 1663a872..5e549a0a 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -6,7 +6,7 @@ import ( "path/filepath" "strconv" - "github.com/github/gh-actions-pin/internal/tag" + "github.com/github/gh-actions-lock/internal/tag" "gopkg.in/yaml.v3" ) @@ -20,10 +20,10 @@ type Config struct { // be excluded from upgrade suggestions. Cooldown tag.CooldownConfig // Workers is the concurrency limit for pool-parallelized phases. - // Defaults to 8; overridden by GH_ACTIONS_PIN_WORKERS. + // Defaults to 8; overridden by GH_ACTIONS_LOCK_WORKERS. Workers int // StallHintMS is the stall-detection threshold in milliseconds. - // 0 disables the watcher. Overridden by GH_ACTIONS_PIN_STALL_HINT_MS. + // 0 disables the watcher. Overridden by GH_ACTIONS_LOCK_STALL_HINT_MS. StallHintMS int // DebugProgress enables per-phase progress tracing. DebugProgress bool @@ -37,13 +37,13 @@ func Load() Config { Path: p, Workers: 8, StallHintMS: -1, // sentinel: use pinpool default - DebugProgress: envBool("GH_ACTIONS_PIN_DEBUG_PROGRESS"), + DebugProgress: envBool("GH_ACTIONS_LOCK_DEBUG_PROGRESS"), } - if v, err := strconv.Atoi(os.Getenv("GH_ACTIONS_PIN_WORKERS")); err == nil && v > 0 { + if v, err := strconv.Atoi(os.Getenv("GH_ACTIONS_LOCK_WORKERS")); err == nil && v > 0 { c.Workers = v } - if v := os.Getenv("GH_ACTIONS_PIN_STALL_HINT_MS"); v != "" { + if v := os.Getenv("GH_ACTIONS_LOCK_STALL_HINT_MS"); v != "" { if ms, err := strconv.Atoi(v); err == nil { c.StallHintMS = ms } @@ -92,14 +92,14 @@ func loadCooldownFromFile(path string) tag.CooldownConfig { } // configPath returns the path to the config file, respecting -// GH_ACTIONS_PIN_CONFIG for testing/demos. +// GH_ACTIONS_LOCK_CONFIG for testing/demos. func configPath() string { - if p := os.Getenv("GH_ACTIONS_PIN_CONFIG"); p != "" { + if p := os.Getenv("GH_ACTIONS_LOCK_CONFIG"); p != "" { return p } home, err := os.UserHomeDir() if err != nil { return "" } - return filepath.Join(home, ".config", "gh-actions-pin", "config.yml") + return filepath.Join(home, ".config", "gh-actions-lock", "config.yml") } diff --git a/internal/ghapi/client.go b/internal/ghapi/client.go index 75dd41bf..6576d5ff 100644 --- a/internal/ghapi/client.go +++ b/internal/ghapi/client.go @@ -19,8 +19,8 @@ import ( "time" "github.com/cli/go-gh/v2/pkg/api" - "github.com/github/gh-actions-pin/internal/profile" - "github.com/github/gh-actions-pin/internal/syncmap" + "github.com/github/gh-actions-lock/internal/profile" + "github.com/github/gh-actions-lock/internal/syncmap" "golang.org/x/sync/singleflight" ) @@ -105,8 +105,8 @@ func New(hostname string, opts ...ClientOption) (*Client, error) { apiOpts.LogIgnoreEnv = cfg.logIgnore default: base := http.DefaultTransport - // Integration tests: skip TLS verification when GH_ACTIONS_PIN_INSECURE is set. - if os.Getenv("GH_ACTIONS_PIN_INSECURE") != "" { + // Integration tests: skip TLS verification when GH_ACTIONS_LOCK_INSECURE is set. + if os.Getenv("GH_ACTIONS_LOCK_INSECURE") != "" { base = &http.Transport{ TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // integration tests only } diff --git a/internal/ghapi/graphql_action_files.go b/internal/ghapi/graphql_action_files.go index 8fedeb15..d790960c 100644 --- a/internal/ghapi/graphql_action_files.go +++ b/internal/ghapi/graphql_action_files.go @@ -8,7 +8,7 @@ import ( "strings" "github.com/cli/go-gh/v2/pkg/api" - "github.com/github/gh-actions-pin/internal/profile" + "github.com/github/gh-actions-lock/internal/profile" ) // ActionFileRequest identifies a GitHub Action ref to resolve via GraphQL. diff --git a/internal/ghapi/graphql_peel.go b/internal/ghapi/graphql_peel.go index cafd0317..650db727 100644 --- a/internal/ghapi/graphql_peel.go +++ b/internal/ghapi/graphql_peel.go @@ -3,7 +3,7 @@ package ghapi import ( "context" - "github.com/github/gh-actions-pin/internal/profile" + "github.com/github/gh-actions-lock/internal/profile" ) // tagObjectPeelQuery resolves both the type of the object at $oid and the diff --git a/internal/ghapi/graphql_peel_test.go b/internal/ghapi/graphql_peel_test.go index 628631ca..983dedd1 100644 --- a/internal/ghapi/graphql_peel_test.go +++ b/internal/ghapi/graphql_peel_test.go @@ -4,7 +4,7 @@ import ( "context" "testing" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" ) func TestPeelTagObject_Tag(t *testing.T) { diff --git a/internal/ghapi/graphql_reachability.go b/internal/ghapi/graphql_reachability.go index 7df60b97..408771ee 100644 --- a/internal/ghapi/graphql_reachability.go +++ b/internal/ghapi/graphql_reachability.go @@ -8,7 +8,7 @@ import ( "strings" "github.com/cli/go-gh/v2/pkg/api" - "github.com/github/gh-actions-pin/internal/profile" + "github.com/github/gh-actions-lock/internal/profile" ) // batchReachabilitySize is the maximum number of branches per GraphQL query. diff --git a/internal/ghapi/repos_dedup_test.go b/internal/ghapi/repos_dedup_test.go index 2ae024c5..2d11f807 100644 --- a/internal/ghapi/repos_dedup_test.go +++ b/internal/ghapi/repos_dedup_test.go @@ -8,7 +8,7 @@ import ( "testing" "time" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" ) // countingTransport is a RoundTripper that records how many times each URL diff --git a/internal/ghapi/repos_test.go b/internal/ghapi/repos_test.go index 067c371c..0c2c5610 100644 --- a/internal/ghapi/repos_test.go +++ b/internal/ghapi/repos_test.go @@ -5,7 +5,7 @@ import ( "net/http" "testing" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" ) func TestOrderedBranches(t *testing.T) { diff --git a/internal/lockfile/convertor.go b/internal/lockfile/convertor.go index 44a883ef..2bcf78ec 100644 --- a/internal/lockfile/convertor.go +++ b/internal/lockfile/convertor.go @@ -6,7 +6,7 @@ import ( "fmt" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" + "github.com/github/gh-actions-lock/internal/dep" ) // depToPin converts a dep.Dependency into a parserlock.Pin without any diff --git a/internal/lockfile/direct_tracker.go b/internal/lockfile/direct_tracker.go index aa424dea..e6e163e1 100644 --- a/internal/lockfile/direct_tracker.go +++ b/internal/lockfile/direct_tracker.go @@ -2,7 +2,7 @@ package lockfile import ( parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" + "github.com/github/gh-actions-lock/internal/dep" ) // DirectTracker captures, by dep index, which resolved deps correspond to a diff --git a/internal/lockfile/state.go b/internal/lockfile/state.go index c75ae93d..78224797 100644 --- a/internal/lockfile/state.go +++ b/internal/lockfile/state.go @@ -11,14 +11,14 @@ import ( "sync" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" + "github.com/github/gh-actions-lock/internal/dep" "golang.org/x/sync/singleflight" ) // lockfileHeader is prepended to every write of the lockfile. It warns // humans away from hand-editing and points them at the CLI that owns it. -const lockfileHeader = "# This file is machine-generated by `gh actions-pin`.\n" + - "# Do not edit by hand; run `gh actions-pin` to update.\n" + +const lockfileHeader = "# This file is machine-generated by `gh actions-lock`.\n" + + "# Do not edit by hand; run `gh actions-lock` to update.\n" + "# Docs: https://gh.io/actions-lockfile\n" // MetadataResolver fetches the owner/repo numeric IDs for a NWO. The store @@ -79,7 +79,7 @@ func LoadStateAt(lockfilePath string, meta MetadataResolver) (*State, error) { // tool that reads this lockfile"), so name the concrete command // for this binary here. if errors.Is(err, parserlock.ErrFutureVersion) { - return nil, fmt.Errorf("reading %s: %w; run `gh extension upgrade gh-actions-pin` to update", parserlock.Path, err) + return nil, fmt.Errorf("reading %s: %w; run `gh extension upgrade gh-actions-lock` to update", parserlock.Path, err) } // Any other parse failure (corrupt YAML, unknown fields, a // dependency entry missing a required key) is surfaced, not @@ -270,7 +270,7 @@ func (s *State) Set(ctx context.Context, workflowKey string, deps []dep.Dependen // dep arrives branchless; reuse the recorded branch. Only a new pin errors. if d.Branch == "" { if existing, ok := s.file.Dependencies[pinKey]; !ok || existing.Branch == "" { - return fmt.Errorf("%s@%s: branch is required in lockfile metadata; run `gh actions-pin` to populate it", d.NWO, d.Ref) + return fmt.Errorf("%s@%s: branch is required in lockfile metadata; run `gh actions-lock` to populate it", d.NWO, d.Ref) } } keyToPin[d.Key()] = pinKey diff --git a/internal/lockfile/state_test.go b/internal/lockfile/state_test.go index f2f1f9ed..2c72cbb4 100644 --- a/internal/lockfile/state_test.go +++ b/internal/lockfile/state_test.go @@ -9,8 +9,8 @@ import ( "testing" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/workflowfile" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/workflowfile" ) type fakeMetadataResolver struct{} @@ -451,7 +451,7 @@ func TestState_RefusesFutureVersionLockfile(t *testing.T) { if !errors.Is(err, parserlock.ErrFutureVersion) { t.Errorf("error does not match ErrFutureVersion sentinel: %v", err) } - if !strings.Contains(err.Error(), "gh extension upgrade gh-actions-pin") { + if !strings.Contains(err.Error(), "gh extension upgrade gh-actions-lock") { t.Errorf("error should include upgrade-path hint, got: %v", err) } @@ -736,8 +736,8 @@ func TestState_BumpTransitiveRemoval(t *testing.T) { // its next write. If this fails intentionally, regenerate the golden and treat // it as a format migration. func TestState_SaveFormatIsStable(t *testing.T) { - const golden = "# This file is machine-generated by `gh actions-pin`.\n" + - "# Do not edit by hand; run `gh actions-pin` to update.\n" + + const golden = "# This file is machine-generated by `gh actions-lock`.\n" + + "# Do not edit by hand; run `gh actions-lock` to update.\n" + "# Docs: https://gh.io/actions-lockfile\n" + "version: 'v0.0.1'\n" + "workflows:\n" + diff --git a/internal/pin/commit.go b/internal/pin/commit.go index 7ba7aa80..6fa302f2 100644 --- a/internal/pin/commit.go +++ b/internal/pin/commit.go @@ -7,10 +7,10 @@ import ( "runtime" "strings" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/lockfile" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/workflowfile" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/lockfile" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/workflowfile" "golang.org/x/sync/errgroup" ) diff --git a/internal/pin/plan.go b/internal/pin/plan.go index 0ae30ea1..289b158f 100644 --- a/internal/pin/plan.go +++ b/internal/pin/plan.go @@ -8,13 +8,13 @@ import ( "time" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/lockfile" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/resolve" - "github.com/github/gh-actions-pin/internal/tag" - "github.com/github/gh-actions-pin/internal/workflowfile" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/lockfile" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/resolve" + "github.com/github/gh-actions-lock/internal/tag" + "github.com/github/gh-actions-lock/internal/workflowfile" ) // PlanOptions configures the Plan pass. diff --git a/internal/pin/plan_test.go b/internal/pin/plan_test.go index 18a732aa..ce8fdb29 100644 --- a/internal/pin/plan_test.go +++ b/internal/pin/plan_test.go @@ -4,13 +4,13 @@ import ( "context" "testing" - "github.com/github/gh-actions-pin/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/pipeline/checks" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/resolve" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) diff --git a/internal/pin/record.go b/internal/pin/record.go index 11a07e0e..2872fc71 100644 --- a/internal/pin/record.go +++ b/internal/pin/record.go @@ -14,7 +14,7 @@ import ( const ( schemaVersion = "run-record/v1" - toolName = "gh-actions-pin" + toolName = "gh-actions-lock" retentionAge = 14 * 24 * time.Hour retentionCount = 50 ) @@ -220,7 +220,7 @@ func logDir() (string, error) { if err != nil { return "", err } - return filepath.Join(base, "gh-actions-pin", "logs"), nil + return filepath.Join(base, "gh-actions-lock", "logs"), nil } func gcLogs(dir string) { diff --git a/internal/pin/record_test.go b/internal/pin/record_test.go index e5cb50e6..1ade708b 100644 --- a/internal/pin/record_test.go +++ b/internal/pin/record_test.go @@ -204,7 +204,7 @@ func TestRecord_MarshalJSON(t *testing.T) { // Check tool info var tool toolInfo require.NoError(t, json.Unmarshal(raw["tool"], &tool)) - assert.Equal(t, "gh-actions-pin", tool.Name) + assert.Equal(t, "gh-actions-lock", tool.Name) assert.Equal(t, "1.2.3", tool.Version) // Check actions are present diff --git a/internal/pin/retain_impostor_test.go b/internal/pin/retain_impostor_test.go index 964c1057..bed4e848 100644 --- a/internal/pin/retain_impostor_test.go +++ b/internal/pin/retain_impostor_test.go @@ -6,10 +6,10 @@ import ( "path/filepath" "testing" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/lockfile" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/workflowfile" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/lockfile" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/workflowfile" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) diff --git a/internal/pinpool/pool.go b/internal/pinpool/pool.go index 463d0d4f..377e1142 100644 --- a/internal/pinpool/pool.go +++ b/internal/pinpool/pool.go @@ -18,7 +18,7 @@ const DefaultWorkers = 8 // DefaultStallThreshold is how long a slot may sit on the same status before // the watcher tags it with a "(still working…)" hint. Tunable via the -// GH_ACTIONS_PIN_STALL_HINT_MS env var; set to 0 to disable the watcher. +// GH_ACTIONS_LOCK_STALL_HINT_MS env var; set to 0 to disable the watcher. const DefaultStallThreshold = 5 * time.Second // stallHintText is the dim suffix the watcher appends to a stalled slot. Kept @@ -44,10 +44,10 @@ type Reporter interface { UpdateLabel(label string) } -// resolveStallThreshold reads GH_ACTIONS_PIN_STALL_HINT_MS. "0" disables; any +// resolveStallThreshold reads GH_ACTIONS_LOCK_STALL_HINT_MS. "0" disables; any // other unparseable value falls back to the default. Parsed once per Run. func resolveStallThreshold() time.Duration { - v := os.Getenv("GH_ACTIONS_PIN_STALL_HINT_MS") + v := os.Getenv("GH_ACTIONS_LOCK_STALL_HINT_MS") if v == "" { return DefaultStallThreshold } diff --git a/internal/pinpool/pool_test.go b/internal/pinpool/pool_test.go index 502f8f8f..3d57dfdd 100644 --- a/internal/pinpool/pool_test.go +++ b/internal/pinpool/pool_test.go @@ -258,7 +258,7 @@ func TestRunDefaultWorkersWhenNonPositive(t *testing.T) { // watcher must call SetWorkerHint with the stall text. Uses a small env-var // threshold so the test budget stays well under a second. func TestRunStallWatcherFiresHint(t *testing.T) { - t.Setenv("GH_ACTIONS_PIN_STALL_HINT_MS", "30") + t.Setenv("GH_ACTIONS_LOCK_STALL_HINT_MS", "30") ui := &fakeReporter{} jobs := []int{1} @@ -292,7 +292,7 @@ func TestRunStallWatcherFiresHint(t *testing.T) { // during one slow job has it cleared when the slot transitions to a new job // (or exits idle). Without this, "(still working…)" leaks across jobs. func TestRunStallWatcherClearsHintOnUpdate(t *testing.T) { - t.Setenv("GH_ACTIONS_PIN_STALL_HINT_MS", "20") + t.Setenv("GH_ACTIONS_LOCK_STALL_HINT_MS", "20") ui := &fakeReporter{} jobs := []int{1, 2} @@ -335,9 +335,9 @@ func TestRunStallWatcherClearsHintOnUpdate(t *testing.T) { } // TestRunStallWatcherDisabledByZeroThreshold confirms users can opt out by -// setting GH_ACTIONS_PIN_STALL_HINT_MS=0 — no SetWorkerHint calls at all. +// setting GH_ACTIONS_LOCK_STALL_HINT_MS=0 — no SetWorkerHint calls at all. func TestRunStallWatcherDisabledByZeroThreshold(t *testing.T) { - t.Setenv("GH_ACTIONS_PIN_STALL_HINT_MS", "0") + t.Setenv("GH_ACTIONS_LOCK_STALL_HINT_MS", "0") ui := &fakeReporter{} jobs := []int{1} @@ -364,7 +364,7 @@ func TestRunStallWatcherDisabledByZeroThreshold(t *testing.T) { // that completes before the threshold, then assert no hint events occurred // in a quiet window after Run returned. func TestRunStallWatcherStopsBeforeReturn(t *testing.T) { - t.Setenv("GH_ACTIONS_PIN_STALL_HINT_MS", "25") + t.Setenv("GH_ACTIONS_LOCK_STALL_HINT_MS", "25") ui := &fakeReporter{} jobs := []int{1} diff --git a/internal/pipeline/checks/category.go b/internal/pipeline/checks/category.go index 70041b35..beea8008 100644 --- a/internal/pipeline/checks/category.go +++ b/internal/pipeline/checks/category.go @@ -57,7 +57,7 @@ const ( // lockfile. Under --no-onboard the tool refuses to add new entries: the // workflow/action is skipped and surfaced rather than silently pinned. // Already-tracked entries are still re-pinned. The operator must onboard - // explicitly (run `gh actions-pin check` without --no-onboard) to add it. + // explicitly (run `gh actions-lock check` without --no-onboard) to add it. OnboardingRequired Category = "onboarding-required" // VersionRef is an informational nudge: a dependency is pinned with a // ref that is not a full semver tag (e.g. v4, v3.1, main). Full semver diff --git a/internal/pipeline/checks/finding.go b/internal/pipeline/checks/finding.go index 59735b8f..10af6cab 100644 --- a/internal/pipeline/checks/finding.go +++ b/internal/pipeline/checks/finding.go @@ -2,7 +2,7 @@ package checks import ( parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" + "github.com/github/gh-actions-lock/internal/dep" ) // Finding represents a single diagnosed issue (or clean bill) for a workflow. diff --git a/internal/pipeline/checks/impostor.go b/internal/pipeline/checks/impostor.go index 77ed891f..c2244636 100644 --- a/internal/pipeline/checks/impostor.go +++ b/internal/pipeline/checks/impostor.go @@ -4,10 +4,10 @@ import ( "context" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/resolve" - "github.com/github/gh-actions-pin/internal/tag" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/resolve" + "github.com/github/gh-actions-lock/internal/tag" ) // ReachabilityChecker is the subset of resolve.Resolver needed to verify diff --git a/internal/pipeline/checks/impostor_test.go b/internal/pipeline/checks/impostor_test.go index 7bff2e8a..54abb835 100644 --- a/internal/pipeline/checks/impostor_test.go +++ b/internal/pipeline/checks/impostor_test.go @@ -4,11 +4,11 @@ import ( "context" "testing" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/resolve" - "github.com/github/gh-actions-pin/internal/tag" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/resolve" + "github.com/github/gh-actions-lock/internal/tag" ) type fakeReachabilityChecker struct { diff --git a/internal/pipeline/checks/misleading.go b/internal/pipeline/checks/misleading.go index 66a1bb95..7a1a3d44 100644 --- a/internal/pipeline/checks/misleading.go +++ b/internal/pipeline/checks/misleading.go @@ -6,7 +6,7 @@ import ( "strings" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/internal/resolve" ) // checkMisleadingSha emits MisleadingSHA when a uses: ref looks @@ -107,7 +107,7 @@ func checkRefMovedAndForgery(ctx context.Context, pw ParsedWorkflow, depIndex ma f.Severity = SeverityWarning f.Confidence = ConfidenceHigh f.Detail = fmt.Sprintf("ref %s now resolves to %s, lockfile pins %s", ref.Ref, parserlock.ShortSHA(sha), parserlock.ShortSHA(pin.Hex)) - f.Remediation = "re-run `gh actions-pin` to refresh the lock entry" + f.Remediation = "re-run `gh actions-lock` to refresh the lock entry" out = append(out, f) if imp, ok := liveRefImpostorFinding(pw, ref, sha, r); ok { out = append(out, imp) diff --git a/internal/pipeline/checks/parsed.go b/internal/pipeline/checks/parsed.go index bb0c042b..6a9d5ab2 100644 --- a/internal/pipeline/checks/parsed.go +++ b/internal/pipeline/checks/parsed.go @@ -4,7 +4,7 @@ import ( "strings" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" + "github.com/github/gh-actions-lock/internal/dep" ) // ParsedWorkflow holds the per-workflow parse result that both phases need. diff --git a/internal/pipeline/checks/resolver.go b/internal/pipeline/checks/resolver.go index d2b8ad2e..8567c771 100644 --- a/internal/pipeline/checks/resolver.go +++ b/internal/pipeline/checks/resolver.go @@ -3,9 +3,9 @@ package checks import ( "context" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/resolve" ) // CheckResolver is the surface the resolver-bound checks need. The diff --git a/internal/pipeline/checks/run.go b/internal/pipeline/checks/run.go index e06b47f9..63f586a6 100644 --- a/internal/pipeline/checks/run.go +++ b/internal/pipeline/checks/run.go @@ -5,8 +5,8 @@ import ( "strings" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/workflowfile" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/workflowfile" ) // RunChecks evaluates all enabled validators against the given parsed diff --git a/internal/pipeline/checks/run_test.go b/internal/pipeline/checks/run_test.go index 62b215ec..aeba24b2 100644 --- a/internal/pipeline/checks/run_test.go +++ b/internal/pipeline/checks/run_test.go @@ -7,7 +7,7 @@ import ( "testing" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/internal/resolve" ) // Typed map keys for the test stub: a small struct per lookup tuple so diff --git a/internal/pipeline/checks/structural.go b/internal/pipeline/checks/structural.go index bf70f259..93d78a0a 100644 --- a/internal/pipeline/checks/structural.go +++ b/internal/pipeline/checks/structural.go @@ -5,7 +5,7 @@ import ( "strings" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" + "github.com/github/gh-actions-lock/internal/dep" ) // checkNotPinned emits NotPinned for any uses: ref that has no @@ -33,7 +33,7 @@ func checkNotPinned(pw ParsedWorkflow, depPins []parserlock.Pin, depIndex map[st } f := newRefFinding(pw, ref, NotPinned, SeverityError, ConfidenceHigh) f.Detail = fmt.Sprintf("used in workflow but not pinned in lockfile (%s@%s)", formatUseName(ref.Owner, ref.Repo, ref.Path), ref.Ref) - f.Remediation = "pin with `gh actions-pin`" + f.Remediation = "pin with `gh actions-lock`" out = append(out, f) } return out @@ -98,7 +98,7 @@ func checkRefChanged(pw ParsedWorkflow, depPins []parserlock.Pin) []Finding { p := candidates[0] f := newRefFinding(pw, ref, RefChanged, SeverityError, ConfidenceHigh) f.Detail = fmt.Sprintf("workflow uses ref %q but lockfile pins %q", ref.Ref, p.Ref) - f.Remediation = "re-run `gh actions-pin` to refresh the lockfile, or revert the uses: line" + f.Remediation = "re-run `gh actions-lock` to refresh the lockfile, or revert the uses: line" f.Dependency = synthDep(ref, p.Hex) out = append(out, f) } @@ -137,7 +137,7 @@ func checkStale(pw ParsedWorkflow, depPins []parserlock.Pin) []Finding { Severity: SeverityWarning, Confidence: ConfidenceHigh, Detail: fmt.Sprintf("lockfile pins %s@%s but no uses: in this workflow references it", nwoLower(p.Owner, p.Repo), p.Ref), - Remediation: "remove the entry or re-run `gh actions-pin`", + Remediation: "remove the entry or re-run `gh actions-lock`", Dependency: &dep.Dependency{ NWO: strings.ToLower(p.NWO), Ref: p.Ref, diff --git a/internal/pipeline/diagnose.go b/internal/pipeline/diagnose.go index 9f07aa29..3a05cc8c 100644 --- a/internal/pipeline/diagnose.go +++ b/internal/pipeline/diagnose.go @@ -6,12 +6,12 @@ import ( "context" "fmt" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/lockfile" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/lockfile" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/resolve" ) // DiagnoseParsed runs the engine diagnostics for each pre-parsed workflow. @@ -82,7 +82,7 @@ func diagnoseOneParsed(ctx context.Context, pw checks.ParsedWorkflow, r *resolve Severity: checks.SeverityError, Confidence: checks.ConfidenceHigh, Detail: fmt.Sprintf("failed to read dependencies: %s", pw.DepsErr), - Remediation: "fix or regenerate the dependencies: section with `gh actions-pin`", + Remediation: "fix or regenerate the dependencies: section with `gh actions-lock`", DocURL: DocURLFor(checks.NotPinned), }) return wr diff --git a/internal/pipeline/doc_urls.go b/internal/pipeline/doc_urls.go index 5f578ce4..1af6919a 100644 --- a/internal/pipeline/doc_urls.go +++ b/internal/pipeline/doc_urls.go @@ -1,6 +1,6 @@ package pipeline -import "github.com/github/gh-actions-pin/internal/pipeline/checks" +import "github.com/github/gh-actions-lock/internal/pipeline/checks" // Documentation URLs for each finding Category. // diff --git a/internal/pipeline/finding_enrich.go b/internal/pipeline/finding_enrich.go index 83587e76..bd07f6ae 100644 --- a/internal/pipeline/finding_enrich.go +++ b/internal/pipeline/finding_enrich.go @@ -1,9 +1,9 @@ package pipeline import ( - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/pipeline/checks" ) // attachParent looks up the dep's composite-expansion parents (if any) diff --git a/internal/pipeline/impostor_parity_test.go b/internal/pipeline/impostor_parity_test.go index 0a240f34..3cc70ac4 100644 --- a/internal/pipeline/impostor_parity_test.go +++ b/internal/pipeline/impostor_parity_test.go @@ -3,11 +3,11 @@ package pipeline import ( "testing" - "github.com/github/gh-actions-pin/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/resolve" ) const ( diff --git a/internal/pipeline/parse.go b/internal/pipeline/parse.go index 3dcf7219..14651325 100644 --- a/internal/pipeline/parse.go +++ b/internal/pipeline/parse.go @@ -5,13 +5,13 @@ import ( "strings" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/lockfile" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/resolve" - "github.com/github/gh-actions-pin/internal/workflowfile" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/lockfile" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/resolve" + "github.com/github/gh-actions-lock/internal/workflowfile" ) // Diagnose scans workflows and produces findings for each. diff --git a/internal/pipeline/reach_findings.go b/internal/pipeline/reach_findings.go index 42f3a746..734d0a76 100644 --- a/internal/pipeline/reach_findings.go +++ b/internal/pipeline/reach_findings.go @@ -2,10 +2,10 @@ package pipeline import ( "fmt" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/resolve" ) // reachabilityComplementFindings covers the cases the engine doesn't: diff --git a/internal/pipeline/reach_findings_test.go b/internal/pipeline/reach_findings_test.go index bd219b77..dc81102c 100644 --- a/internal/pipeline/reach_findings_test.go +++ b/internal/pipeline/reach_findings_test.go @@ -4,10 +4,10 @@ import ( "sort" "testing" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/resolve" ) func reachResult(d dep.Dependency, status resolve.ReachabilityStatus, detail string) resolve.ReachabilityResult { diff --git a/internal/pipeline/reach_partition.go b/internal/pipeline/reach_partition.go index 5dc2d5b0..9f0279c5 100644 --- a/internal/pipeline/reach_partition.go +++ b/internal/pipeline/reach_partition.go @@ -1,10 +1,10 @@ package pipeline import ( - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/resolve" "strings" ) diff --git a/internal/pipeline/resolver_test.go b/internal/pipeline/resolver_test.go index 304e4f14..8c2bc3d6 100644 --- a/internal/pipeline/resolver_test.go +++ b/internal/pipeline/resolver_test.go @@ -3,10 +3,10 @@ package pipeline import ( "testing" - "github.com/github/gh-actions-pin/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/resolve" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/resolve" ) // TestPrewarmedResolver_LockedAndLiveCoexist verifies that locked-SHA diff --git a/internal/pipeline/run.go b/internal/pipeline/run.go index 73435247..47dca1e2 100644 --- a/internal/pipeline/run.go +++ b/internal/pipeline/run.go @@ -4,13 +4,13 @@ import ( "context" "strings" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/lockfile" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/pipeline/checks" - "github.com/github/gh-actions-pin/internal/profile" - "github.com/github/gh-actions-pin/internal/resolve" - "github.com/github/gh-actions-pin/internal/tag" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/lockfile" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/profile" + "github.com/github/gh-actions-lock/internal/resolve" + "github.com/github/gh-actions-lock/internal/tag" ) // RunOptions configures the Run pipeline. diff --git a/internal/pipeline/run_test.go b/internal/pipeline/run_test.go index 9fd35b81..521f8c96 100644 --- a/internal/pipeline/run_test.go +++ b/internal/pipeline/run_test.go @@ -4,8 +4,8 @@ import ( "testing" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/pipeline/checks" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/pipeline/checks" "github.com/stretchr/testify/assert" ) diff --git a/internal/resolve/ancestry.go b/internal/resolve/ancestry.go index 86a8513d..af503bf1 100644 --- a/internal/resolve/ancestry.go +++ b/internal/resolve/ancestry.go @@ -6,7 +6,7 @@ import ( "net/http" "strings" - "github.com/github/gh-actions-pin/internal/ghapi" + "github.com/github/gh-actions-lock/internal/ghapi" ) // ReachabilityStatus represents the result of a commit reachability check. diff --git a/internal/resolve/ancestry_test.go b/internal/resolve/ancestry_test.go index 3c22f28c..377621a1 100644 --- a/internal/resolve/ancestry_test.go +++ b/internal/resolve/ancestry_test.go @@ -5,7 +5,7 @@ import ( "net/http" "testing" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" ) func TestCheckAncestry_SameSHA(t *testing.T) { diff --git a/internal/resolve/cacheentry.go b/internal/resolve/cacheentry.go index ee8fe46d..9ac8d43f 100644 --- a/internal/resolve/cacheentry.go +++ b/internal/resolve/cacheentry.go @@ -6,7 +6,7 @@ package resolve -import "github.com/github/gh-actions-pin/internal/dep" +import "github.com/github/gh-actions-lock/internal/dep" // resolvedEntry is the domain cache value for a resolved action ref. type resolvedEntry struct { diff --git a/internal/resolve/discover_test.go b/internal/resolve/discover_test.go index b005a31c..3506a148 100644 --- a/internal/resolve/discover_test.go +++ b/internal/resolve/discover_test.go @@ -5,9 +5,9 @@ import ( "strings" "testing" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" - "github.com/github/gh-actions-pin/internal/pinpool" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/pinpool" ) func TestDiscoverContaining_PrefersHintTag(t *testing.T) { diff --git a/internal/resolve/discovery.go b/internal/resolve/discovery.go index 74309342..f50eea39 100644 --- a/internal/resolve/discovery.go +++ b/internal/resolve/discovery.go @@ -8,9 +8,9 @@ import ( "sync/atomic" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/pinpool" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/pinpool" ) // LatestRef returns the highest stable tag for an action repository. diff --git a/internal/resolve/peel.go b/internal/resolve/peel.go index c3a91248..9756411b 100644 --- a/internal/resolve/peel.go +++ b/internal/resolve/peel.go @@ -3,7 +3,7 @@ package resolve import ( "context" - "github.com/github/gh-actions-pin/internal/ghapi" + "github.com/github/gh-actions-lock/internal/ghapi" ) // PeelTagObject reports whether sha is an annotated tag object in owner/repo diff --git a/internal/resolve/peel_test.go b/internal/resolve/peel_test.go index c36d21a5..57b2061c 100644 --- a/internal/resolve/peel_test.go +++ b/internal/resolve/peel_test.go @@ -4,7 +4,7 @@ import ( "context" "testing" - "github.com/github/gh-actions-pin/internal/ghapi" + "github.com/github/gh-actions-lock/internal/ghapi" ) func TestPeelTagObject_CachesPositive(t *testing.T) { diff --git a/internal/resolve/reachability.go b/internal/resolve/reachability.go index 308e1837..71b1decd 100644 --- a/internal/resolve/reachability.go +++ b/internal/resolve/reachability.go @@ -6,9 +6,9 @@ import ( "sync" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/pinpool" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/pinpool" ) // CheckReachability verifies that the pinned SHA is reachable from at least diff --git a/internal/resolve/reachability_test.go b/internal/resolve/reachability_test.go index cf5a8bc8..238e5ede 100644 --- a/internal/resolve/reachability_test.go +++ b/internal/resolve/reachability_test.go @@ -6,8 +6,8 @@ import ( "strings" "testing" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" ) func TestCheckReachability_CacheHit(t *testing.T) { diff --git a/internal/resolve/resolver.go b/internal/resolve/resolver.go index 6ec24b12..3939b9bb 100644 --- a/internal/resolve/resolver.go +++ b/internal/resolve/resolver.go @@ -8,11 +8,11 @@ import ( "sync" "time" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/pinpool" - "github.com/github/gh-actions-pin/internal/profile" - "github.com/github/gh-actions-pin/internal/syncmap" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/pinpool" + "github.com/github/gh-actions-lock/internal/profile" + "github.com/github/gh-actions-lock/internal/syncmap" "golang.org/x/sync/singleflight" ) diff --git a/internal/resolve/resolver_test.go b/internal/resolve/resolver_test.go index 1ae264d6..6dc441de 100644 --- a/internal/resolve/resolver_test.go +++ b/internal/resolve/resolver_test.go @@ -8,10 +8,10 @@ import ( "time" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" - "github.com/github/gh-actions-pin/internal/pinpool" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/pinpool" ) // seedCache populates r.cache with the supplied entries and returns r so it can diff --git a/internal/resolve/reverse_lookup.go b/internal/resolve/reverse_lookup.go index 5e9811b8..5eaea58b 100644 --- a/internal/resolve/reverse_lookup.go +++ b/internal/resolve/reverse_lookup.go @@ -7,8 +7,8 @@ import ( "strings" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" ) // DiscoverContaining returns (tag, branch) for sha in owner/repo, using diff --git a/internal/resolve/reverse_lookup_test.go b/internal/resolve/reverse_lookup_test.go index f83ffd00..006fa719 100644 --- a/internal/resolve/reverse_lookup_test.go +++ b/internal/resolve/reverse_lookup_test.go @@ -4,10 +4,10 @@ import ( "context" "testing" - "github.com/github/gh-actions-pin/internal/dep" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" - "github.com/github/gh-actions-pin/internal/pinpool" + "github.com/github/gh-actions-lock/internal/dep" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/pinpool" ) func TestFindContainingBranch_ExactHeadMatch(t *testing.T) { diff --git a/internal/tag/tags.go b/internal/tag/tags.go index 3cb916e5..de70dc22 100644 --- a/internal/tag/tags.go +++ b/internal/tag/tags.go @@ -7,8 +7,8 @@ import ( "time" parserlock "github.com/github/actions-lockfile/go/pkg/lockfile" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/syncmap" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/syncmap" "golang.org/x/sync/singleflight" ) diff --git a/internal/tag/tags_keys_test.go b/internal/tag/tags_keys_test.go index 8cab5ea8..7b0ccc62 100644 --- a/internal/tag/tags_keys_test.go +++ b/internal/tag/tags_keys_test.go @@ -4,7 +4,7 @@ import ( "context" "testing" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" ) // TestTagLister_CaseInsensitiveCacheKeys locks in the discipline that all diff --git a/internal/tag/tags_test.go b/internal/tag/tags_test.go index 004a76c0..250e804b 100644 --- a/internal/tag/tags_test.go +++ b/internal/tag/tags_test.go @@ -4,7 +4,7 @@ import ( "context" "testing" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" ) // TestMatchesSHA verifies a pin matches the tag's peeled commit SHA. diff --git a/internal/tag/testing.go b/internal/tag/testing.go index 6bef6dd5..56f67ef5 100644 --- a/internal/tag/testing.go +++ b/internal/tag/testing.go @@ -3,8 +3,8 @@ package tag import ( "testing" - "github.com/github/gh-actions-pin/internal/ghapi" - "github.com/github/gh-actions-pin/internal/ghapi/httpmock" + "github.com/github/gh-actions-lock/internal/ghapi" + "github.com/github/gh-actions-lock/internal/ghapi/httpmock" ) // NewListerForTest builds a Lister wired to a mock registry. diff --git a/internal/ui/ui.go b/internal/ui/ui.go index 0a6621ca..843aee35 100644 --- a/internal/ui/ui.go +++ b/internal/ui/ui.go @@ -1,4 +1,4 @@ -// Package ui provides terminal-aware output formatting for gh-actions-pin. +// Package ui provides terminal-aware output formatting for gh-actions-lock. // It respects NO_COLOR, CLICOLOR, and TTY detection on stderr (not stdout) // so that color works correctly even when stdout is piped (e.g. --json mode). package ui @@ -98,12 +98,12 @@ func (u *UI) MarkHeadless() { u.output = termenv.NewOutput(u.w, termenv.WithProfile(termenv.Ascii)) } -// progressTrace caches the result of GH_ACTIONS_PIN_DEBUG_PROGRESS once. When +// progressTrace caches the result of GH_ACTIONS_LOCK_DEBUG_PROGRESS once. When // set, every UpdateLabel and SetWorkerStatus call writes a timestamped JSONL // line to a dedicated trace file so we can audit phase transitions and verify // the worker pool is actually fanning out without depending on visual // inspection of the spinner. The path is resolved from the env var: "1" or -// "true" maps to $TMPDIR/gh-actions-pin-progress.log, anything else is treated +// "true" maps to $TMPDIR/gh-actions-lock-progress.log, anything else is treated // as a literal path. var ( progressTraceMu sync.Mutex @@ -112,13 +112,13 @@ var ( ) func resolveProgressTracePath() string { - v := os.Getenv("GH_ACTIONS_PIN_DEBUG_PROGRESS") + v := os.Getenv("GH_ACTIONS_LOCK_DEBUG_PROGRESS") switch v { case "": return "" case "1", "true", "yes": dir := os.TempDir() - return dir + "/gh-actions-pin-progress.log" + return dir + "/gh-actions-lock-progress.log" default: return v } @@ -150,7 +150,7 @@ func (u *UI) traceProgress(kind, payload string) { return } progressTraceFile = f - fmt.Fprintf(f, "# gh-actions-pin progress trace %s\n", time.Now().Format(time.RFC3339)) + fmt.Fprintf(f, "# gh-actions-lock progress trace %s\n", time.Now().Format(time.RFC3339)) } rec := struct { Time string `json:"time"` diff --git a/script/sync-early-access-release b/script/sync-early-access-release index 3154deb3..443e0d0c 100755 --- a/script/sync-early-access-release +++ b/script/sync-early-access-release @@ -5,10 +5,10 @@ usage() { cat <<'USAGE' Usage: script/sync-early-access-release [tag] -Sync a gh-actions-pin release to the early-access distribution repository. +Sync a gh-actions-lock release to the early-access distribution repository. Environment: - SOURCE_REPOSITORY Source repository. Defaults to github/gh-actions-pin. + SOURCE_REPOSITORY Source repository. Defaults to github/gh-actions-lock. TARGET_REPOSITORY Target repository. Defaults to github-early-access/actions-locked-dependencies. SOURCE_TOKEN Optional token for reading the source release. TARGET_TOKEN Optional token for writing the target release. @@ -33,7 +33,7 @@ require_command() { require_command gh require_command jq -source_repository="${SOURCE_REPOSITORY:-github/gh-actions-pin}" +source_repository="${SOURCE_REPOSITORY:-github/gh-actions-lock}" target_repository="${TARGET_REPOSITORY:-github-early-access/actions-locked-dependencies}" tag="${1:-${RELEASE_TAG:-}}" diff --git a/test/integration/harness.rb b/test/integration/harness.rb index f9667d44..cbc32eaf 100644 --- a/test/integration/harness.rb +++ b/test/integration/harness.rb @@ -1,6 +1,6 @@ # frozen_string_literal: true -# Integration test harness for gh-actions-pin. +# Integration test harness for gh-actions-lock. # # Modes: # Batch: ruby test/integration/run.rb [filter] @@ -302,7 +302,7 @@ def prepare(binary, profile_dir: nil) return prepare_live(binary, profile_dir: profile_dir) end - dir = Dir.mktmpdir("actions-pin-test-") + dir = Dir.mktmpdir("actions-lock-test-") @workflows.each do |path, content| full = File.join(dir, ".github", "workflows", path) @@ -351,7 +351,7 @@ def prepare(binary, profile_dir: nil) # Prepare a live repo scenario: shallow-clone the real repo and run # against its actual workflows. No stub server — hits real GitHub API. def prepare_live(binary, profile_dir: nil) - dir = Dir.mktmpdir("actions-pin-live-") + dir = Dir.mktmpdir("actions-lock-live-") nwo = @live_repo $stderr.print "\e[2m cloning #{nwo}…\e[0m " @@ -892,7 +892,7 @@ def yaml_scalar(v) # ── Interactive shell ────────────────────────────────────────── def shell - puts "\e[1mgh-actions-pin integration shell\e[0m" + puts "\e[1mgh-actions-lock integration shell\e[0m" puts "Binary: #{@binary}" puts "Scenarios: #{@scenarios.size} loaded" puts "Type \e[36mhelp\e[0m for commands, \e[36mlist\e[0m for scenarios." @@ -1089,11 +1089,11 @@ def shell print " \e[2mbuilding…\e[0m " $stdout.flush t0 = Process.clock_gettime(Process::CLOCK_MONOTONIC) - ok = system("go", "build", "-o", "gh-actions-pin", "./cmd/gh-actions-pin", chdir: repo_root) + ok = system("go", "build", "-o", "gh-actions-lock", "./cmd/gh-actions-lock", chdir: repo_root) elapsed = Process.clock_gettime(Process::CLOCK_MONOTONIC) - t0 if ok puts "\e[32m✓\e[0m \e[2m(#{format_elapsed(elapsed)})\e[0m" - @binary = File.join(repo_root, "gh-actions-pin") + @binary = File.join(repo_root, "gh-actions-lock") else puts "\e[31m✗ build failed\e[0m" end @@ -1298,13 +1298,13 @@ def format_elapsed(seconds) end def find_binary - repo_bin = File.expand_path("../../../gh-actions-pin", __FILE__) + repo_bin = File.expand_path("../../../gh-actions-lock", __FILE__) return repo_bin if File.executable?(repo_bin) - gobin = File.join(ENV["HOME"], "go", "bin", "gh-actions-pin") + gobin = File.join(ENV["HOME"], "go", "bin", "gh-actions-lock") return gobin if File.executable?(gobin) - raise "Cannot find gh-actions-pin binary. Run `make build` first." + raise "Cannot find gh-actions-lock binary. Run `make build` first." end def find_scenario(name) @@ -1752,7 +1752,7 @@ def print_review_report(verdicts) end # Write report file - report_path = "/tmp/actions-pin-review-#{Time.now.strftime('%Y%m%d-%H%M%S')}.md" + report_path = "/tmp/actions-lock-review-#{Time.now.strftime('%Y%m%d-%H%M%S')}.md" File.write(report_path, render_review_markdown(verdicts)) puts " \e[2mReport saved:\e[0m \e[36m#{report_path}\e[0m" puts @@ -1761,7 +1761,7 @@ def print_review_report(verdicts) print " \e[34mUpload as gist?\e[0m \e[2m[y/N]\e[0m > " answer = $stdin.gets&.strip&.downcase if answer == "y" - desc = "gh-actions-pin review #{Time.now.strftime('%Y-%m-%d %H:%M')}" + desc = "gh-actions-lock review #{Time.now.strftime('%Y-%m-%d %H:%M')}" out = `gh gist create #{Shellwords.shellescape(report_path)} --desc #{Shellwords.shellescape(desc)} 2>&1`.strip if $?.success? puts " \e[32m✓\e[0m #{out}" @@ -1776,9 +1776,9 @@ def upload_partial_report(verdicts, total) remaining = total - reviewed md = render_review_markdown(verdicts) md += "\n---\n_Partial report: #{reviewed}/#{total} reviewed, #{remaining} remaining._\n" - path = "/tmp/actions-pin-review-partial-#{Time.now.strftime('%Y%m%d-%H%M%S')}.md" + path = "/tmp/actions-lock-review-partial-#{Time.now.strftime('%Y%m%d-%H%M%S')}.md" File.write(path, md) - desc = "gh-actions-pin review (partial #{reviewed}/#{total}) #{Time.now.strftime('%Y-%m-%d %H:%M')}" + desc = "gh-actions-lock review (partial #{reviewed}/#{total}) #{Time.now.strftime('%Y-%m-%d %H:%M')}" out = `gh gist create #{Shellwords.shellescape(path)} --desc #{Shellwords.shellescape(desc)} 2>&1`.strip if $?.success? puts " \e[32m✓ shared:\e[0m #{out}" diff --git a/test/integration/run.rb b/test/integration/run.rb index 358d388f..f0c73203 100644 --- a/test/integration/run.rb +++ b/test/integration/run.rb @@ -1,6 +1,6 @@ # frozen_string_literal: true -# Integration scenarios for gh-actions-pin. +# Integration scenarios for gh-actions-lock. # # Scenarios are defined in the shared catalog (test/scenarios/catalog.yml) # and hydrated here with stub server wiring and custom assertions. Both @@ -63,8 +63,8 @@ def build_lockfile(workflows:, dependencies: {}) end.join("\n") <<~YAML - # This file is machine-generated by `gh actions-pin`. - # Do not edit by hand; run `gh actions-pin` to update. + # This file is machine-generated by `gh actions-lock`. + # Do not edit by hand; run `gh actions-lock` to update. # Docs: https://gh.io/actions-lockfile version: 'v0.0.1' workflows: @@ -375,7 +375,7 @@ def golden_json_diff(expected, actual, path) }, "future_version" => -> { <<~YAML - # This file is machine-generated by `gh actions-pin`. + # This file is machine-generated by `gh actions-lock`. version: 'v99.99.99' workflows: {} dependencies: {} diff --git a/test/scenarios/catalog.yml b/test/scenarios/catalog.yml index eb3f07b2..f2d94d5e 100644 --- a/test/scenarios/catalog.yml +++ b/test/scenarios/catalog.yml @@ -1,4 +1,4 @@ -# Shared scenario catalog for gh-actions-pin integration tests. +# Shared scenario catalog for gh-actions-lock integration tests. # # Both the Ruby integration harness (test/integration/) and the Go scenario # loader (test/scenarios/) consume this file. Each scenario describes: @@ -974,7 +974,7 @@ scenarios: dependency: actions/checkout@v4 detail: actions/checkout@v4 has no lockfile entry; --no-onboard refuses to add new workflows or actions doc_url: "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions" - remediation: onboard it first with `gh actions-pin check` (without --no-onboard) + remediation: onboard it first with `gh actions-lock check` (without --no-onboard) severity: info workflow: .github/workflows/ci.yml lockfile_version: v0.0.1 @@ -986,7 +986,7 @@ scenarios: dependency: actions/checkout@v4 detail: actions/checkout@v4 has no lockfile entry; --no-onboard refuses to add new workflows or actions doc_url: "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions" - remediation: onboard it first with `gh actions-pin check` (without --no-onboard) + remediation: onboard it first with `gh actions-lock check` (without --no-onboard) severity: info workflow: .github/workflows/ci.yml path: .github/workflows/ci.yml @@ -1021,7 +1021,7 @@ scenarios: dependency: actions/setup-node@v4 detail: actions/setup-node@v4 has no lockfile entry; --no-onboard refuses to add new workflows or actions doc_url: "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions" - remediation: onboard it first with `gh actions-pin check` (without --no-onboard) + remediation: onboard it first with `gh actions-lock check` (without --no-onboard) severity: info workflow: .github/workflows/ci.yml lockfile_version: v0.0.1 @@ -1039,7 +1039,7 @@ scenarios: dependency: actions/setup-node@v4 detail: actions/setup-node@v4 has no lockfile entry; --no-onboard refuses to add new workflows or actions doc_url: "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions" - remediation: onboard it first with `gh actions-pin check` (without --no-onboard) + remediation: onboard it first with `gh actions-lock check` (without --no-onboard) severity: info workflow: .github/workflows/ci.yml path: .github/workflows/ci.yml @@ -1089,7 +1089,7 @@ scenarios: dependency: actions/checkout@v4 detail: actions/checkout@v4 has no lockfile entry; --no-onboard refuses to add new workflows or actions doc_url: "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions" - remediation: onboard it first with `gh actions-pin check` (without --no-onboard) + remediation: onboard it first with `gh actions-lock check` (without --no-onboard) severity: info workflow: .github/workflows/deploy.yml - category: onboarding-required @@ -1097,7 +1097,7 @@ scenarios: dependency: actions/setup-node@v4 detail: actions/setup-node@v4 has no lockfile entry; --no-onboard refuses to add new workflows or actions doc_url: "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions" - remediation: onboard it first with `gh actions-pin check` (without --no-onboard) + remediation: onboard it first with `gh actions-lock check` (without --no-onboard) severity: info workflow: .github/workflows/deploy.yml lockfile_version: v0.0.1 @@ -1118,7 +1118,7 @@ scenarios: dependency: actions/checkout@v4 detail: actions/checkout@v4 has no lockfile entry; --no-onboard refuses to add new workflows or actions doc_url: "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions" - remediation: onboard it first with `gh actions-pin check` (without --no-onboard) + remediation: onboard it first with `gh actions-lock check` (without --no-onboard) severity: info workflow: .github/workflows/deploy.yml - category: onboarding-required @@ -1126,7 +1126,7 @@ scenarios: dependency: actions/setup-node@v4 detail: actions/setup-node@v4 has no lockfile entry; --no-onboard refuses to add new workflows or actions doc_url: "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions" - remediation: onboard it first with `gh actions-pin check` (without --no-onboard) + remediation: onboard it first with `gh actions-lock check` (without --no-onboard) severity: info workflow: .github/workflows/deploy.yml path: .github/workflows/deploy.yml From d7345488c00f927c61fdb76f2428c189f554382d Mon Sep 17 00:00:00 2001 From: Jeff Martin Date: Sun, 14 Jun 2026 14:13:21 -0500 Subject: [PATCH 2/3] harness: rename missed GH_ACTIONS_PIN_* env vars GH_ACTIONS_PIN_INSECURE and GH_ACTIONS_PIN_CACHE_DIR were missed in the initial rename pass because the harness.rb sed only targeted the binary/extension name pattern, not the env var prefix. --- test/integration/harness.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/integration/harness.rb b/test/integration/harness.rb index cbc32eaf..a37cfa4e 100644 --- a/test/integration/harness.rb +++ b/test/integration/harness.rb @@ -331,11 +331,11 @@ def prepare(binary, profile_dir: nil) env["GH_HOST"] = "127.0.0.1:#{server.port}" token = env.delete("GH_TOKEN") || "stub-token" env["GH_ENTERPRISE_TOKEN"] = token - env["GH_ACTIONS_PIN_INSECURE"] = "1" + env["GH_ACTIONS_LOCK_INSECURE"] = "1" end @setup_blocks.each { |b| b.call(dir) } - env["GH_ACTIONS_PIN_CACHE_DIR"] = File.join(dir, ".cache") + env["GH_ACTIONS_LOCK_CACHE_DIR"] = File.join(dir, ".cache") cmd = [binary] + @args if profile_dir @@ -363,7 +363,7 @@ def prepare_live(binary, profile_dir: nil) env = @env.dup @setup_blocks.each { |b| b.call(dir) } - env["GH_ACTIONS_PIN_CACHE_DIR"] = File.join(dir, ".cache") + env["GH_ACTIONS_LOCK_CACHE_DIR"] = File.join(dir, ".cache") cmd = [binary] + @args if profile_dir From befa1df6037268fd5b8028445dccebd7d1c0adc0 Mon Sep 17 00:00:00 2001 From: Jeff Martin Date: Sun, 14 Jun 2026 14:45:47 -0500 Subject: [PATCH 3/3] bump actions-lockfile to v0.0.3 --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 939e39e9..39724c3e 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 ) -require github.com/github/actions-lockfile/go v0.0.1 +require github.com/github/actions-lockfile/go v0.0.3 require ( github.com/AlecAivazis/survey/v2 v2.3.7 // indirect diff --git a/go.sum b/go.sum index 254f70d0..350eb139 100644 --- a/go.sum +++ b/go.sum @@ -33,8 +33,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys= github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= -github.com/github/actions-lockfile/go v0.0.1 h1:Xi9KmIq1DUnfZOlp8SJyEU2kgk8Y7g8ghtNg1xFiv6s= -github.com/github/actions-lockfile/go v0.0.1/go.mod h1:kp8pDNXwrr3fC+6Mgmh/ZODa6AsIEC+bmf1CLQ/7DEs= +github.com/github/actions-lockfile/go v0.0.3 h1:pvvbEnsmKtBiiUJ2I5n35W3Uei3EvmnZe1PKJ3q4YrY= +github.com/github/actions-lockfile/go v0.0.3/go.mod h1:kp8pDNXwrr3fC+6Mgmh/ZODa6AsIEC+bmf1CLQ/7DEs= github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 h1:2VTzZjLZBgl62/EtslCrtky5vbi9dd7HrQPQIx6wqiw= github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI= github.com/henvic/httpretty v0.0.6 h1:JdzGzKZBajBfnvlMALXXMVQWxWMF/ofTy8C3/OSUTxs=