diff --git a/.github/workflows/sql-ci.yml b/.github/workflows/sql-ci.yml index 531383f..901817e 100644 --- a/.github/workflows/sql-ci.yml +++ b/.github/workflows/sql-ci.yml @@ -1,7 +1,7 @@ name: sql-ci -# Reusable SQL CI for BOTH tiers: pinned setup-python, and -# sqlfluff lint (dialect-aware) plus an optional caller command passed via env. +# Reusable SQL CI for BOTH tiers: pinned setup-uv, and sqlfluff lint +# (dialect-aware) plus an optional caller command passed via env. on: workflow_call: @@ -9,9 +9,6 @@ on: runner: type: string default: 'ubuntu-latest' - python_version: - type: string - default: '3.13' working_directory: type: string default: '.' diff --git a/CHANGELOG.md b/CHANGELOG.md index bbd19ac..6521ddc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,24 @@ ## [Unreleased] +### Fixed + +- **The catalog recorded four action pins that no workflow used.** `setup-node`, + `setup-java`, `setup-swift`, and `checkov-action` had drifted a version behind + the SHA their `used_by` workflows actually reference — `setup-swift` by a full + major (`v2.4.0` recorded, `v3` shipped). `validate_catalog.py` checked only the + pin's *shape* and that `used_by` paths existed, never that the pin matched + reality, so the gate stayed green while the declared source of truth was wrong + in four places. Pins synced and `validate_catalog.py` now fails when a + catalog pin does not appear verbatim in each of its `used_by` workflows. +- **`sql-ci.yml` declared a `python_version` input that nothing read.** It was + the only never-read input across all reusables; the workflow has no + `setup-python` step at all and provisions Python through `setup-uv`. A caller + passing it got a silently ignored value. Input removed and the header comment + corrected from "pinned setup-python" to "pinned setup-uv". +- `docs/12-community-dx.md` listed five community-health files as still missing; + all five have shipped. Only the optional `.github/FUNDING.yml` remains absent. + ### Added - **Self-application of the public OSS security suite.** This repository shipped diff --git a/catalog/tools.yml b/catalog/tools.yml index 300eac0..e9a4e7f 100644 --- a/catalog/tools.yml +++ b/catalog/tools.yml @@ -220,11 +220,11 @@ tools: name: swift-actions/setup-swift homepage: "https://github.com/swift-actions/setup-swift" kind: action - current_version: "v2.4.0" - pin: "swift-actions/setup-swift@7ca6abe6b3b0e8b5421b88be48feee39cbf52c6a" + current_version: v3 + pin: swift-actions/setup-swift@364295d9c23900ce04d4e5cc708387921b4e50f9 used_by: - .github/workflows/swift-ci.yml - last_verified: "2026-07-08" + last_verified: 2026-07-25 - id: setup-r name: r-lib/actions/setup-r @@ -370,11 +370,11 @@ tools: name: bridgecrewio/checkov-action homepage: "https://github.com/bridgecrewio/checkov-action" kind: action - current_version: "v12.3112.0" - pin: "bridgecrewio/checkov-action@a7683e7b72a04503521247973281ec8142e1ac1f" + current_version: v12.3114.0 + pin: bridgecrewio/checkov-action@7b972723c44fb3d256283fac96fae5d7c1894bb7 used_by: - .github/workflows/iac-scan.yml - last_verified: "2026-07-13" + last_verified: 2026-07-25 - id: github-action-benchmark name: benchmark-action/github-action-benchmark @@ -391,13 +391,13 @@ tools: name: actions/setup-node homepage: "https://github.com/actions/setup-node" kind: action - current_version: "v6.4.0" - pin: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" + current_version: v7.0.0 + pin: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 used_by: - .github/workflows/benchmark.yml - .github/workflows/benchmark-compare.yml - .github/workflows/mutation-testing.yml - last_verified: "2026-07-12" + last_verified: 2026-07-25 - id: setup-uv name: astral-sh/setup-uv @@ -465,12 +465,12 @@ tools: name: actions/setup-java homepage: "https://github.com/actions/setup-java" kind: action - current_version: "v5.5.0" - pin: "actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a" + current_version: v5.6.0 + pin: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 used_by: - .github/workflows/java-ci.yml - .github/workflows/kotlin-android-ci.yml - last_verified: "2026-07-12" + last_verified: 2026-07-25 - id: setup-terraform name: hashicorp/setup-terraform diff --git a/docs/12-community-dx.md b/docs/12-community-dx.md index 0021217..691f548 100644 --- a/docs/12-community-dx.md +++ b/docs/12-community-dx.md @@ -21,10 +21,10 @@ GitHub-native community surfaces and the health checklist. | `.github/FUNDING.yml` | Sponsorship links | This repository already ships `README.md`, `LICENSE`, `NOTICE`, `SECURITY.md`, -and `.github/CODEOWNERS`. The remaining files (`CONTRIBUTING.md`, -`CODE_OF_CONDUCT.md`, `SUPPORT.md`, `.github/ISSUE_TEMPLATE/`, -`.github/PULL_REQUEST_TEMPLATE.md`, `.github/FUNDING.yml`) are the community -surfaces to add for a fully green health check. +`.github/CODEOWNERS`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SUPPORT.md`, +`.github/ISSUE_TEMPLATE/`, and `.github/PULL_REQUEST_TEMPLATE.md`. Only +`.github/FUNDING.yml` is absent, and it is optional — add it if sponsorship is +ever accepted. ## Issue forms diff --git a/scripts/validate_catalog.py b/scripts/validate_catalog.py index 60e2c65..932a037 100644 --- a/scripts/validate_catalog.py +++ b/scripts/validate_catalog.py @@ -169,8 +169,29 @@ def check() -> list[str]: if kind == "container" and not CONTAINER_PIN_RE.match(pin): problems.append(f"tool `{tid}`: container pin is not digest-pinned: {pin}") for used_by in tool.get("used_by", []): - if not (REPO_ROOT / used_by).exists(): + used_path = REPO_ROOT / used_by + if not used_path.exists(): problems.append(f"tool `{tid}`: used_by path does not exist: {used_by}") + continue + # The catalog is the declared source of truth for supply-chain + # posture, so a pin it records must be the pin the workflow + # actually uses. Checking only the pin's shape let four tools + # drift a full version behind (setup-swift by a major) while + # the gate stayed green. + if kind != "action" or not isinstance(pin, str) or "@" not in pin: + continue + action_ref, pinned_sha = pin.split("@", 1) + actual = set( + re.findall( + rf"{re.escape(action_ref)}@([0-9a-f]{{40}})", + used_path.read_text(encoding="utf-8"), + ) + ) + for found in sorted(actual - {pinned_sha}): + problems.append( + f"tool `{tid}`: catalog pin {pinned_sha} does not match " + f"{found} used in {used_by}" + ) elif tools_doc is not None: problems.append("tools.yml: expected a top-level mapping")