axodotdev / axodotdev/cargo-dist

Difficultly maintaining pinned github actions

Open
#2,297 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
2.1k
Forks
149
Avg merge
1d 11h
Merged PRs (30d)
32

Description

In one of the repos I contribute to (https://github.com/open-telemetry/weaver) we use pinned github actions and then renovate to maintain them.

I was able to get the pin setting working as described [here](https://axodotdev.github.io/cargo-dist/book/ci/customizing.html#pinned-actions-commits. However my issue arose when renovate started proposing updates as dist-workspace.yml was not being updated. After multiple attempts I can renovate to detect the dependencies in dist-workspace.yml but determine the new digest always fails. It appears not to be supported.

I was wondering could we get a new setting preserve `github-action-version` which if true, sources the version for the actions from the existing releases.yml file rather than dist-workspace.yml. This would be the nicest solution and our recommendation/guidance would become, set it to true if you are using a dependency management tool such as renovate.

Contributor guide

Open the contributing guide

Research direction

Start with the pinned-actions guidance linked in the issue, then compare how dist-workspace.yml and releases.yml currently represent GitHub Action versions. Determine where a preserve github-action-version setting belongs and how it should interact with Renovate. Done means the setting reliably sources action versions from releases.yml and the recommendation is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, rust
Domain
ci-cd, release
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.