From ae970a238e78d9f9f9a84ddc50627eae87693378 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sat, 25 Jul 2026 00:10:45 +0500 Subject: [PATCH] fix(catalog): sync drifted action pins and remove a dead input MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The catalog is the declared source of truth for supply-chain posture, and it was wrong about four tools. setup-node, setup-java, setup-swift and checkov-action each recorded a pin that appears in no workflow — setup-swift by a full major version. validate_catalog.py checked the pin's shape and that used_by paths exist, but never that the recorded pin is the pin actually used, so the gate stayed green over four wrong answers. Sync the four entries and close the hole: the validator now fails when a catalog pin does not appear verbatim in each used_by workflow. Verified by negative control — reintroducing the old setup-node SHA makes it fail with the exact mismatch, and reverting makes it pass. sql-ci.yml declared a python_version input that nothing read; it was the only never-read input across all reusables. The workflow has no setup-python step and provisions Python through setup-uv, so a caller passing python_version got a silently ignored value. Remove it and correct the header comment. Also refresh docs/12-community-dx.md, which listed five community-health files as missing when all five have shipped. Signed-off-by: Danil Silantyev --- .github/workflows/sql-ci.yml | 7 ++----- CHANGELOG.md | 18 ++++++++++++++++++ catalog/tools.yml | 24 ++++++++++++------------ docs/12-community-dx.md | 8 ++++---- scripts/validate_catalog.py | 23 ++++++++++++++++++++++- 5 files changed, 58 insertions(+), 22 deletions(-) diff --git a/.github/workflows/sql-ci.yml b/.github/workflows/sql-ci.yml index 531383f..901817e 100644 --- a/.github/workflows/sql-ci.yml +++ b/.github/workflows/sql-ci.yml @@ -1,7 +1,7 @@ name: sql-ci -# Reusable SQL CI for BOTH tiers: pinned setup-python, and -# sqlfluff lint (dialect-aware) plus an optional caller command passed via env. +# Reusable SQL CI for BOTH tiers: pinned setup-uv, and sqlfluff lint +# (dialect-aware) plus an optional caller command passed via env. on: workflow_call: @@ -9,9 +9,6 @@ on: runner: type: string default: 'ubuntu-latest' - python_version: - type: string - default: '3.13' working_directory: type: string default: '.' diff --git a/CHANGELOG.md b/CHANGELOG.md index bbd19ac..6521ddc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,24 @@ ## [Unreleased] +### Fixed + +- **The catalog recorded four action pins that no workflow used.** `setup-node`, + `setup-java`, `setup-swift`, and `checkov-action` had drifted a version behind + the SHA their `used_by` workflows actually reference — `setup-swift` by a full + major (`v2.4.0` recorded, `v3` shipped). `validate_catalog.py` checked only the + pin's *shape* and that `used_by` paths existed, never that the pin matched + reality, so the gate stayed green while the declared source of truth was wrong + in four places. Pins synced and `validate_catalog.py` now fails when a + catalog pin does not appear verbatim in each of its `used_by` workflows. +- **`sql-ci.yml` declared a `python_version` input that nothing read.** It was + the only never-read input across all reusables; the workflow has no + `setup-python` step at all and provisions Python through `setup-uv`. A caller + passing it got a silently ignored value. Input removed and the header comment + corrected from "pinned setup-python" to "pinned setup-uv". +- `docs/12-community-dx.md` listed five community-health files as still missing; + all five have shipped. Only the optional `.github/FUNDING.yml` remains absent. + ### Added - **Self-application of the public OSS security suite.** This repository shipped diff --git a/catalog/tools.yml b/catalog/tools.yml index 300eac0..e9a4e7f 100644 --- a/catalog/tools.yml +++ b/catalog/tools.yml @@ -220,11 +220,11 @@ tools: name: swift-actions/setup-swift homepage: "https://github.com/swift-actions/setup-swift" kind: action - current_version: "v2.4.0" - pin: "swift-actions/setup-swift@7ca6abe6b3b0e8b5421b88be48feee39cbf52c6a" + current_version: v3 + pin: swift-actions/setup-swift@364295d9c23900ce04d4e5cc708387921b4e50f9 used_by: - .github/workflows/swift-ci.yml - last_verified: "2026-07-08" + last_verified: 2026-07-25 - id: setup-r name: r-lib/actions/setup-r @@ -370,11 +370,11 @@ tools: name: bridgecrewio/checkov-action homepage: "https://github.com/bridgecrewio/checkov-action" kind: action - current_version: "v12.3112.0" - pin: "bridgecrewio/checkov-action@a7683e7b72a04503521247973281ec8142e1ac1f" + current_version: v12.3114.0 + pin: bridgecrewio/checkov-action@7b972723c44fb3d256283fac96fae5d7c1894bb7 used_by: - .github/workflows/iac-scan.yml - last_verified: "2026-07-13" + last_verified: 2026-07-25 - id: github-action-benchmark name: benchmark-action/github-action-benchmark @@ -391,13 +391,13 @@ tools: name: actions/setup-node homepage: "https://github.com/actions/setup-node" kind: action - current_version: "v6.4.0" - pin: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" + current_version: v7.0.0 + pin: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 used_by: - .github/workflows/benchmark.yml - .github/workflows/benchmark-compare.yml - .github/workflows/mutation-testing.yml - last_verified: "2026-07-12" + last_verified: 2026-07-25 - id: setup-uv name: astral-sh/setup-uv @@ -465,12 +465,12 @@ tools: name: actions/setup-java homepage: "https://github.com/actions/setup-java" kind: action - current_version: "v5.5.0" - pin: "actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a" + current_version: v5.6.0 + pin: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 used_by: - .github/workflows/java-ci.yml - .github/workflows/kotlin-android-ci.yml - last_verified: "2026-07-12" + last_verified: 2026-07-25 - id: setup-terraform name: hashicorp/setup-terraform diff --git a/docs/12-community-dx.md b/docs/12-community-dx.md index 0021217..691f548 100644 --- a/docs/12-community-dx.md +++ b/docs/12-community-dx.md @@ -21,10 +21,10 @@ GitHub-native community surfaces and the health checklist. | `.github/FUNDING.yml` | Sponsorship links | This repository already ships `README.md`, `LICENSE`, `NOTICE`, `SECURITY.md`, -and `.github/CODEOWNERS`. The remaining files (`CONTRIBUTING.md`, -`CODE_OF_CONDUCT.md`, `SUPPORT.md`, `.github/ISSUE_TEMPLATE/`, -`.github/PULL_REQUEST_TEMPLATE.md`, `.github/FUNDING.yml`) are the community -surfaces to add for a fully green health check. +`.github/CODEOWNERS`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, `SUPPORT.md`, +`.github/ISSUE_TEMPLATE/`, and `.github/PULL_REQUEST_TEMPLATE.md`. Only +`.github/FUNDING.yml` is absent, and it is optional — add it if sponsorship is +ever accepted. ## Issue forms diff --git a/scripts/validate_catalog.py b/scripts/validate_catalog.py index 60e2c65..932a037 100644 --- a/scripts/validate_catalog.py +++ b/scripts/validate_catalog.py @@ -169,8 +169,29 @@ def check() -> list[str]: if kind == "container" and not CONTAINER_PIN_RE.match(pin): problems.append(f"tool `{tid}`: container pin is not digest-pinned: {pin}") for used_by in tool.get("used_by", []): - if not (REPO_ROOT / used_by).exists(): + used_path = REPO_ROOT / used_by + if not used_path.exists(): problems.append(f"tool `{tid}`: used_by path does not exist: {used_by}") + continue + # The catalog is the declared source of truth for supply-chain + # posture, so a pin it records must be the pin the workflow + # actually uses. Checking only the pin's shape let four tools + # drift a full version behind (setup-swift by a major) while + # the gate stayed green. + if kind != "action" or not isinstance(pin, str) or "@" not in pin: + continue + action_ref, pinned_sha = pin.split("@", 1) + actual = set( + re.findall( + rf"{re.escape(action_ref)}@([0-9a-f]{{40}})", + used_path.read_text(encoding="utf-8"), + ) + ) + for found in sorted(actual - {pinned_sha}): + problems.append( + f"tool `{tid}`: catalog pin {pinned_sha} does not match " + f"{found} used in {used_by}" + ) elif tools_doc is not None: problems.append("tools.yml: expected a top-level mapping")