Skip to content

Normalize action hashes to point to commits#565

Draft
llucax wants to merge 14 commits intofrequenz-floss:v0.x.xfrom
llucax:fix-hashes
Draft

Normalize action hashes to point to commits#565
llucax wants to merge 14 commits intofrequenz-floss:v0.x.xfrom
llucax:fix-hashes

Conversation

@llucax
Copy link
Copy Markdown
Contributor

@llucax llucax commented Apr 1, 2026

The hashes we are using are the annotatted git tag object, but depenabot like to have the pins to the actual commit object the tag points to, not the tag itself.

So we replace the hash to make dependabot happy:

Action Change
gh-action-setup-git 16952aa -> f9d86a0 (v1.0.0)
gh-action-setup-python-with-deps 0d0d77e -> e4d0b2e (v1.0.2)

llucax added 11 commits March 31, 2026 18:09
This variable defaults to true/yes when the license is Proprietary and
will be used to automatically switch features on and off in templates.

Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Instead of adding credential passing to both private and public repos,
add them uncommented only for private repos.

Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Private repos should not publish-docs nor publish-to-pypi, so we only
create those jobs for public repos.

Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
This job is now only added for public repos, so there is no need to
pass credentials.

Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Golden tests are done for all repo types setting them as private repos,
and a full generation integration smoke test is done for an API private
repo.

Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
The hashes we are using are the annotatted git tag object, but depenabot
like to have the pins to the actual commit object the tag points to, not
the tag itself.

So we replace the hash to make dependabot happy:

gh-action-setup-git:                16952aa -> f9d86a0 (v1.0.0)
gh-action-setup-python-with-deps:   0d0d77e -> e4d0b2e (v1.0.2)

Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
@llucax llucax requested a review from a team as a code owner April 1, 2026 11:04
@llucax llucax requested review from simonvoelcker and removed request for a team April 1, 2026 11:04
@github-actions github-actions bot added the part:template Affects the cookiecutter template files label Apr 1, 2026
@llucax llucax marked this pull request as draft April 1, 2026 11:04
@llucax
Copy link
Copy Markdown
Contributor Author

llucax commented Apr 1, 2026

Depends on #555.

llucax added 3 commits April 1, 2026 13:19
Add a migration script step to update the GitHub Action hashes for
`gh-action-setup-git` and `gh-action-setup-python-with-deps` to point to
the actual commit object instead of the annotated tag object.

Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

part:template Affects the cookiecutter template files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant