action-drift #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: action-drift | |
| # Detector, not gate (METHOD section 8): a determinism-pinned action is | |
| # monitored, never silently refreshed. On drift this workflow opens an issue; | |
| # it never edits workflow files and never blocks a merge. The job stays green | |
| # even when it files an issue, so drift surfaces in the Issues tab (the chosen | |
| # signal channel) rather than as a redundant red run + email. | |
| on: | |
| schedule: | |
| - cron: "0 6 * * 1" # every Monday 06:00 UTC | |
| workflow_dispatch: {} # manual trigger for testing | |
| permissions: | |
| contents: read | |
| issues: write | |
| jobs: | |
| drift: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.13" | |
| - name: Check action-pin drift | |
| id: drift | |
| run: | | |
| set +e | |
| report="$(python scripts/check_action_drift.py .github/workflows/)" | |
| code=$? | |
| echo "$report" | |
| { | |
| echo "report<<DRIFT_EOF" | |
| echo "$report" | |
| echo "DRIFT_EOF" | |
| echo "code=$code" | |
| } >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| - name: Open an issue on drift | |
| if: steps.drift.outputs.code != '0' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -e | |
| title="Action-pin drift detected" | |
| # Anti-spam: do not stack a second issue if one is already open. | |
| existing="$(gh issue list --state open --search "$title in:title" --json number --jq 'length')" | |
| if [ "$existing" -gt 0 ]; then | |
| echo "An open drift issue already exists; not filing a duplicate." | |
| exit 0 | |
| fi | |
| body="$(printf 'The scheduled drift check found action pins that no longer match their upstream tags.\n\n```\n%s\n```\n\nThis is a *detector*: review each finding and re-pin manually (resolve the tag with `git ls-remote`, never auto-refresh). See METHOD section 8.' "${{ steps.drift.outputs.report }}")" | |
| gh issue create --title "$title" --body "$body" |