Skip to content

[actions] Update GitHub Actions versions - 2026-04-12 #25935

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 4 commits into from
Apr 12, 2026
Merged

[actions] Update GitHub Actions versions - 2026-04-12 #25935

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
09e66c1
chore: update GitHub Actions versions - 2026-04-12
github-actions[bot] Apr 12, 2026
8540735
plan: add runtime manager actions to trusted actions list
Copilot Apr 12, 2026
bbaad6f
feat: add runtime manager actions to trusted actions list
Copilot Apr 12, 2026
24d5aa7
fix: guard against empty ActionRepo in runtime trusted actions
Copilot Apr 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/aw/actions-lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,10 +173,10 @@
"version": "v2.2.0",
"sha": "0c5077e51419868618aeaa5fe8019c62421857d6"
},
"ruby/setup-ruby@v1.300.0": {
"ruby/setup-ruby@v1.301.0": {
"repo": "ruby/setup-ruby",
"version": "v1.300.0",
"sha": "e65c17d16e57e481586a6a5a0282698790062f92"
"version": "v1.301.0",
"sha": "4c56a21280b36d862b5fc31348f463d60bdc55d5"
},
"super-linter/super-linter@v8.6.0": {
"repo": "super-linter/super-linter",
Expand Down
6 changes: 3 additions & 3 deletions pkg/workflow/data/action_pins.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,10 +173,10 @@
"version": "v2.2.0",
"sha": "0c5077e51419868618aeaa5fe8019c62421857d6"
},
"ruby/setup-ruby@v1.300.0": {
"ruby/setup-ruby@v1.301.0": {
"repo": "ruby/setup-ruby",
"version": "v1.300.0",
"sha": "e65c17d16e57e481586a6a5a0282698790062f92"
"version": "v1.301.0",
"sha": "4c56a21280b36d862b5fc31348f463d60bdc55d5"
},
"super-linter/super-linter@v8.6.0": {
"repo": "super-linter/super-linter",
Expand Down
27 changes: 21 additions & 6 deletions pkg/workflow/safe_update_enforcement.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,8 +116,23 @@ var ghAwActionPrefixes = []string{
"github/gh-aw-actions/",
}

// runtimeActionRepos is the set of action repos used by the runtime manager.
// These are populated from knownRuntimes at init time so the trusted-action
// list stays in sync with runtime_definitions.go automatically.
var runtimeActionRepos map[string]bool

func init() {
runtimeActionRepos = make(map[string]bool, len(knownRuntimes))
for _, rt := range knownRuntimes {
if rt.ActionRepo != "" {
runtimeActionRepos[rt.ActionRepo] = true
}
}
}

// isTrustedActionRepo reports whether a repo string belongs to a trusted org or project.
// Trusted repos include the "actions/" GitHub org and gh-aw's own infrastructure actions.
// Trusted repos include the "actions/" GitHub org, gh-aw's own infrastructure actions,
// and actions used by the runtime manager (e.g. ruby/setup-ruby, oven-sh/setup-bun).
func isTrustedActionRepo(repo string) bool {
if strings.HasPrefix(repo, githubActionsOrg+"/") {
return true
Expand All @@ -127,15 +142,15 @@ func isTrustedActionRepo(repo string) bool {
return true
}
}
return false
return runtimeActionRepos[repo]
}

// collectActionViolations compares the new action refs against the previous manifest
// and returns two sorted slices: repos that were added and repos that were removed.
// The comparison uses the action repo as the key, so SHA/version changes to an
// already-approved repo are not flagged.
// Actions belonging to the "actions/" GitHub org and gh-aw infrastructure repos are
// always trusted and never flagged.
// Actions belonging to the "actions/" GitHub org, gh-aw infrastructure repos, and
// runtime manager repos are always trusted and never flagged.
func collectActionViolations(manifest *GHAWManifest, actionRefs []string) (added []string, removed []string) {
// Build known repo set from previous manifest.
knownRepos := make(map[string]bool, len(manifest.Actions))
Expand All @@ -151,7 +166,7 @@ func collectActionViolations(manifest *GHAWManifest, actionRefs []string) (added
}

// Find additions: repos present in the new compilation but absent from the manifest.
// Trusted actions (actions/ org, gh-aw infrastructure) are always allowed and never flagged.
// Trusted actions (actions/ org, gh-aw infrastructure, runtime manager) are always allowed and never flagged.
for repo := range newRepos {
if isTrustedActionRepo(repo) {
continue
Expand All @@ -162,7 +177,7 @@ func collectActionViolations(manifest *GHAWManifest, actionRefs []string) (added
}

// Find removals: repos present in the previous manifest but absent from the new compilation.
// Trusted actions (actions/ org, gh-aw infrastructure) are always allowed, so their removal is not flagged.
// Trusted actions (actions/ org, gh-aw infrastructure, runtime manager) are always allowed, so their removal is not flagged.
for repo := range knownRepos {
if isTrustedActionRepo(repo) {
continue
Expand Down