axodotdev / axodotdev/cargo-dist
Difficultly maintaining pinned github actions
- Dominant language
- Rust
- Stars
- 2.1k
- Forks
- 149
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 32
Description
In one of the repos I contribute to (https://github.com/open-telemetry/weaver) we use pinned github actions and then renovate to maintain them.
I was able to get the pin setting working as described [here](https://axodotdev.github.io/cargo-dist/book/ci/customizing.html#pinned-actions-commits. However my issue arose when renovate started proposing updates as dist-workspace.yml was not being updated. After multiple attempts I can renovate to detect the dependencies in dist-workspace.yml but determine the new digest always fails. It appears not to be supported.
I was wondering could we get a new setting preserve `github-action-version` which if true, sources the version for the actions from the existing releases.yml file rather than dist-workspace.yml. This would be the nicest solution and our recommendation/guidance would become, set it to true if you are using a dependency management tool such as renovate.
Contributor guide
Research direction
Start with the pinned-actions guidance linked in the issue, then compare how dist-workspace.yml and releases.yml currently represent GitHub Action versions. Determine where a preserve github-action-version setting belongs and how it should interact with Renovate. Done means the setting reliably sources action versions from releases.yml and the recommendation is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, rust
- Domain
- ci-cd, release
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100