Repository navigation
Use the shared verify-lockfile workflow - #255
Conversation
|
@pullfrog please rebase and review |
Call the reusable workflow instead of keeping a copy of the job, so the gh-actions-lock version is maintained in one place. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4f0b43d to
79e4c50
Compare
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ No new issues found.
Rebased onto main (0e9c675, which added pullfrog.yml). The actions.lock conflict is resolved: actions/checkout@v6.1.0 stays because pullfrog.yml uses it, and actions/checkout@v7.0.1 is dropped because no workflow references it any more. gh actions-lock --verify (v0.4.0) passes locally: "All 7 workflows valid".
I checked the shared restatedev/restate/.github/workflows/verify-lockfile.yml@main. It declares workflow_call, needs no inputs or secrets, asks only for contents: read (the caller grants the same), and checks out the caller's repo with persist-credentials: false. The caller keeps its own name and triggers, so behaviour matches the job it replaces.
One thing to be aware of, not a blocker: @main is a mutable ref, and the lockfile records verify-lockfile.yml as [], so the reusable workflow itself isn't pinned here. Any change merged to restatedev/restate main runs here on the next PR. That's the point of centralising it, and the token is read-only, so the risk is low.
claude-opus-5-5 ｜ 𝕏
Summary
Replaces the copied job in
verify-lockfile.ymlwith a call to the shared workflow inrestatedev/restate(restatedev/restate#5721):The
gh-actions-lockversion is then maintained in one place for all restatedev repositories. Dependabot can't bump it because it is a CLI argument (gh extension install github/gh-actions-lock --pin v0.4.0), not auses:reference. The workflow name and triggers stay as they are.actions.lockis relocked: theverify-lockfile.ymlentry no longer listsactions/checkout, which is now covered by restatedev/restate's own lockfile.verify / verifyinstead ofverify. No branch protection or ruleset in this repository requires the old name.Test plan
gh actions-lockrelock: all workflows validverify / verifypasses on this PR (the shared workflow already passes in the 10 Wave 1 repositories, e.g. Add GitHub Actions workflow lockfile e2e#462)🤖 Generated with Claude Code