Skip to content

Commit 9fdaa4b

Browse files
llucaxllucax
authored
Normalize action hashes to point to commits (#565)
The hashes we are using are the annotatted git tag object, but depenabot like to have the pins to the actual commit object the tag points to, not the tag itself. So we replace the hash to make dependabot happy: | Action | Change | | --------------------------------- | ----------------------------- | | gh-action-setup-git | 16952aa -> f9d86a0 (v1.0.0) | | gh-action-setup-python-with-deps | 0d0d77e -> e4d0b2e (v1.0.2) |
2 parents 800cc50 + 0575b1b commit 9fdaa4b

24 files changed

Lines changed: 151 additions & 106 deletions

File tree

‎RELEASE_NOTES.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,4 @@ But you might still need to adapt your code:
3838
- The unused cross-arch QEMU-based testing infrastructure has been removed. The `.github/containers/nox-cross-arch/` and `.github/containers/test-installation/` directories, as well as the "Cross-Arch Testing" section in `CONTRIBUTING.md`.
3939
- Private repositories now are generated with credentials uncommented and the publishing workflows disabled.
4040
- The issue template chooser (`config.yml`) no longer includes the `contact_links` section for private repositories, since GitHub Discussions are typically disabled for them.
41+
- Normalized the GitHub Action hashes for `gh-action-setup-git` and `gh-action-setup-python-with-deps` to point to the actual commit object, which is what Dependabot expects.

‎cookiecutter/migrate.py‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ def main() -> None:
5454
print("Updating auxiliary GitHub workflows...")
5555
migrate_auxiliary_workflows()
5656
print("=" * 72)
57+
print("Normalizing GitHub Action hashes...")
58+
migrate_gh_actions_hashes()
59+
print("=" * 72)
5760
print("Updating issue template configuration...")
5861
migrate_issue_templates()
5962
print("=" * 72)
@@ -282,6 +285,47 @@ def migrate_auxiliary_workflows() -> None:
282285
)
283286

284287

288+
def migrate_gh_actions_hashes() -> None:
289+
"""Update GitHub Action hashes to point to the actual commit object.
290+
291+
The hashes we were using are the annotated git tag object, but
292+
Dependabot likes to have the pins to the actual commit object the
293+
tag points to, not the tag itself.
294+
"""
295+
replacements = [
296+
(
297+
"frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace",
298+
"frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90",
299+
),
300+
(
301+
"frequenz-floss/gh-action-setup-python-with-deps@"
302+
"0d0d77eac3b54799f31f25a1060ef2c6ebdf9299", # noqa: E501
303+
"frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946", # noqa: E501
304+
),
305+
]
306+
307+
workflows_dir = Path(".github/workflows")
308+
if not workflows_dir.is_dir():
309+
print(f" Skipped {workflows_dir}: directory not found")
310+
return
311+
312+
for wf in sorted(workflows_dir.iterdir()):
313+
if wf.suffix not in (".yml", ".yaml"):
314+
continue
315+
try:
316+
content = wf.read_text(encoding="utf-8")
317+
except OSError:
318+
continue
319+
320+
new_content = content
321+
for old, new in replacements:
322+
new_content = new_content.replace(old, new)
323+
324+
if new_content != content:
325+
replace_file_atomically(wf, new_content)
326+
print(f" Updated {wf}: normalized GitHub Action hashes")
327+
328+
285329
def migrate_issue_templates() -> None:
286330
"""Update issue template configuration for repository privacy.
287331

‎cookiecutter/{{cookiecutter.github_repo_name}}/.github/workflows/ci-pr.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323

2424
steps:
2525
- name: Setup Git
26-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
26+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
2727
{%- endraw %}{% if cookiecutter.private_repo == "yes" %}{% raw %}
2828
with:
2929
username: ${{ secrets.GIT_USER }}
@@ -69,7 +69,7 @@ jobs:
6969
runs-on: ubuntu-24.04
7070
steps:
7171
- name: Setup Git
72-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
72+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
7373
{%- endraw %}{% if cookiecutter.private_repo == "yes" %}{% raw %}
7474
with:
7575
username: ${{ secrets.GIT_USER }}
@@ -82,7 +82,7 @@ jobs:
8282
submodules: true
8383

8484
- name: Setup Python
85-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
85+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
8686
with:
8787
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
8888
dependencies: .[dev-mkdocs]

‎cookiecutter/{{cookiecutter.github_repo_name}}/.github/workflows/ci.yaml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535

3636
steps:
3737
- name: Setup Git
38-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
38+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
3939
{%- endraw %}{% if cookiecutter.private_repo == "yes" %}{% raw %}
4040
with:
4141
username: ${{ secrets.GIT_USER }}
@@ -118,7 +118,7 @@ jobs:
118118

119119
steps:
120120
- name: Setup Git
121-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
121+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
122122
{%- endraw %}{% if cookiecutter.private_repo == "yes" %}{% raw %}
123123
with:
124124
username: ${{ secrets.GIT_USER }}
@@ -131,7 +131,7 @@ jobs:
131131
submodules: true
132132

133133
- name: Setup Python
134-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
134+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
135135
with:
136136
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
137137
dependencies: build
@@ -162,7 +162,7 @@ jobs:
162162

163163
steps:
164164
- name: Setup Git
165-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
165+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
166166
{%- endraw %}{% if cookiecutter.private_repo == "yes" %}{% raw %}
167167
with:
168168
username: ${{ secrets.GIT_USER }}
@@ -193,7 +193,7 @@ jobs:
193193
> pyproject.toml
194194
195195
- name: Setup Python
196-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
196+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
197197
with:
198198
python-version: ${{ matrix.python }}
199199
dependencies: dist/*.whl
@@ -226,7 +226,7 @@ jobs:
226226
runs-on: ubuntu-24.04
227227
steps:
228228
- name: Setup Git
229-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
229+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
230230
{%- endraw %}{% if cookiecutter.private_repo == "yes" %}{% raw %}
231231
with:
232232
username: ${{ secrets.GIT_USER }}
@@ -239,7 +239,7 @@ jobs:
239239
submodules: true
240240

241241
- name: Setup Python
242-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
242+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
243243
with:
244244
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
245245
dependencies: .[dev-mkdocs]
@@ -272,15 +272,15 @@ jobs:
272272
contents: write
273273
steps:
274274
- name: Setup Git
275-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
275+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
276276

277277
- name: Fetch sources
278278
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
279279
with:
280280
submodules: true
281281

282282
- name: Setup Python
283-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
283+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
284284
with:
285285
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
286286
dependencies: .[dev-mkdocs]

‎tests_golden/integration/test_cookiecutter_generation/actor-proprietary/frequenz-actor-test/.github/workflows/ci-pr.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
runs-on: ubuntu-24.04
3434
steps:
3535
- name: Setup Git
36-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
36+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
3737
with:
3838
username: ${{ secrets.GIT_USER }}
3939
password: ${{ secrets.GIT_PASS }}
@@ -44,7 +44,7 @@ jobs:
4444
submodules: true
4545

4646
- name: Setup Python
47-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
47+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
4848
with:
4949
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
5050
dependencies: .[dev-mkdocs]

‎tests_golden/integration/test_cookiecutter_generation/actor-proprietary/frequenz-actor-test/.github/workflows/ci.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ jobs:
8282

8383
steps:
8484
- name: Setup Git
85-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
85+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
8686
with:
8787
username: ${{ secrets.GIT_USER }}
8888
password: ${{ secrets.GIT_PASS }}
@@ -93,7 +93,7 @@ jobs:
9393
submodules: true
9494

9595
- name: Setup Python
96-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
96+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
9797
with:
9898
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
9999
dependencies: build
@@ -124,7 +124,7 @@ jobs:
124124

125125
steps:
126126
- name: Setup Git
127-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
127+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
128128
with:
129129
username: ${{ secrets.GIT_USER }}
130130
password: ${{ secrets.GIT_PASS }}
@@ -153,7 +153,7 @@ jobs:
153153
> pyproject.toml
154154
155155
- name: Setup Python
156-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
156+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
157157
with:
158158
python-version: ${{ matrix.python }}
159159
dependencies: dist/*.whl
@@ -186,7 +186,7 @@ jobs:
186186
runs-on: ubuntu-24.04
187187
steps:
188188
- name: Setup Git
189-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
189+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
190190
with:
191191
username: ${{ secrets.GIT_USER }}
192192
password: ${{ secrets.GIT_PASS }}
@@ -197,7 +197,7 @@ jobs:
197197
submodules: true
198198

199199
- name: Setup Python
200-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
200+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
201201
with:
202202
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
203203
dependencies: .[dev-mkdocs]

‎tests_golden/integration/test_cookiecutter_generation/actor/frequenz-actor-test/.github/workflows/ci-pr.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,15 @@ jobs:
3131
runs-on: ubuntu-24.04
3232
steps:
3333
- name: Setup Git
34-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
34+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
3535

3636
- name: Fetch sources
3737
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3838
with:
3939
submodules: true
4040

4141
- name: Setup Python
42-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
42+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
4343
with:
4444
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
4545
dependencies: .[dev-mkdocs]

‎tests_golden/integration/test_cookiecutter_generation/actor/frequenz-actor-test/.github/workflows/ci.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -80,15 +80,15 @@ jobs:
8080

8181
steps:
8282
- name: Setup Git
83-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
83+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
8484

8585
- name: Fetch sources
8686
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8787
with:
8888
submodules: true
8989

9090
- name: Setup Python
91-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
91+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
9292
with:
9393
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
9494
dependencies: build
@@ -119,7 +119,7 @@ jobs:
119119

120120
steps:
121121
- name: Setup Git
122-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
122+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
123123

124124
- name: Print environment (debug)
125125
run: env
@@ -145,7 +145,7 @@ jobs:
145145
> pyproject.toml
146146
147147
- name: Setup Python
148-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
148+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
149149
with:
150150
python-version: ${{ matrix.python }}
151151
dependencies: dist/*.whl
@@ -178,15 +178,15 @@ jobs:
178178
runs-on: ubuntu-24.04
179179
steps:
180180
- name: Setup Git
181-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
181+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
182182

183183
- name: Fetch sources
184184
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
185185
with:
186186
submodules: true
187187

188188
- name: Setup Python
189-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
189+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
190190
with:
191191
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
192192
dependencies: .[dev-mkdocs]
@@ -218,15 +218,15 @@ jobs:
218218
contents: write
219219
steps:
220220
- name: Setup Git
221-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
221+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
222222

223223
- name: Fetch sources
224224
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
225225
with:
226226
submodules: true
227227

228228
- name: Setup Python
229-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
229+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
230230
with:
231231
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
232232
dependencies: .[dev-mkdocs]

‎tests_golden/integration/test_cookiecutter_generation/api-proprietary/frequenz-api-test/.github/workflows/ci-pr.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121

2222
steps:
2323
- name: Setup Git
24-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
24+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
2525
with:
2626
username: ${{ secrets.GIT_USER }}
2727
password: ${{ secrets.GIT_PASS }}
@@ -62,7 +62,7 @@ jobs:
6262
runs-on: ubuntu-24.04
6363
steps:
6464
- name: Setup Git
65-
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
65+
uses: frequenz-floss/gh-action-setup-git@f9d86a01228ee1cadaac5224d4d7626f1eb23f90 # v1.0.0
6666
with:
6767
username: ${{ secrets.GIT_USER }}
6868
password: ${{ secrets.GIT_PASS }}
@@ -73,7 +73,7 @@ jobs:
7373
submodules: true
7474

7575
- name: Setup Python
76-
uses: frequenz-floss/gh-action-setup-python-with-deps@0d0d77eac3b54799f31f25a1060ef2c6ebdf9299 # v1.0.2
76+
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
7777
with:
7878
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
7979
dependencies: .[dev-mkdocs]

0 commit comments

Comments
 (0)