stacklok / stacklok/frizbee

`frizbee actions` should update composite actions by default too

Open
#242 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
185
Forks
24
Avg merge
5d 6h
Merged PRs (30d)
5

Description

Describe the issue

Hi there!

I ran frizbee actions on a repository and, as expected, it modified all of my workflows to use hash-pinned references where possible. Awesome!

However, I also had a composite action definition (i.e. an action.yml) in the same directory, and frizbee actions did not modify my action's uses: clauses.

Expected behavior

I expected frizbee actions to rewrite both .github/workflows/*.ya?ml and **/action.yml.

Actual behavior

I had to explicitly run frizbee actions action.yml to get it to modify the composite action stored in the same repository.

To Reproduce

Create a repository containing both workflows and composite action definitions. Run frizbee actions, and observe that the former are updated while the latter are not.

What version are you using?

v0.1.7

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the frizbee actions command and trace how it discovers .github/workflows/*.ya?ml and **/action.yml files. Reproduce the behavior with both workflow and composite action definitions, then verify that running without an explicit path updates both kinds of files while preserving the existing workflow behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.