Carlos Florêncio
57 lines
1.8 KiB
Markdown
57 lines
1.8 KiB
Markdown
# Action runtime audit procedure
|
||
|
||
Goal: verify that every `uses:` pin in `.github/workflows/` runs on the
|
||
Node 24 action runtime (or is composite / docker://), so no Node-20
|
||
deprecation warnings are emitted.
|
||
|
||
## Step 1 — collect pins
|
||
|
||
```bash
|
||
grep -rhoE "uses: [^ ]+@[0-9a-f]{40}" .github/workflows/*.yml | sort | uniq -c | sort -rn
|
||
```
|
||
|
||
## Step 2 — check each pinned SHA's runtime
|
||
|
||
For each `owner/repo@<40-hex>` pin, fetch the action manifest at that exact
|
||
commit and read `runs.using`:
|
||
|
||
```bash
|
||
curl -sf "https://raw.githubusercontent.com/<owner>/<repo>/<sha>/action.yml" \
|
||
| grep -A1 "^runs:"
|
||
# action.yml may be action.yaml in some repos; try both.
|
||
```
|
||
|
||
Acceptable values: `node24` (good), `composite` (no runtime of its own —
|
||
inspect inner `uses:` steps, e.g. `actions/upload-pages-artifact` v5 embeds
|
||
`actions/upload-artifact@v7.0.0` which is node24). Reject `node20`.
|
||
|
||
## Step 3 — dereference annotated tags
|
||
|
||
Some pins are the SHA of an annotated tag object rather than a commit
|
||
(e.g. `pnpm/action-setup@a8198c4… # v5`). Dereference before judging:
|
||
|
||
```bash
|
||
gh api repos/<owner>/<repo>/git/tags/<sha> --jq '.object.sha'
|
||
```
|
||
|
||
## Step 4 — resolve target SHAs (when upgrading)
|
||
|
||
For each target tag, resolve the commit SHA and confirm node24:
|
||
|
||
```bash
|
||
sha=$(gh api "repos/<owner>/<repo>/git/refs/tags/<tag>" --jq '.object.sha')
|
||
# if .object.type == "tag", dereference via git/tags/<sha> → .object.sha
|
||
curl -sf "https://raw.githubusercontent.com/<owner>/<repo>/$sha/action.yml" | grep -A1 "^runs:"
|
||
```
|
||
|
||
## Step 5 — final assertion
|
||
|
||
After the upgrade, rerun steps 1–2 and assert:
|
||
|
||
- every `runs.using:` is `node24` or `composite`;
|
||
- every ref is still a 40-char SHA (also covered by `lint-action-pinning.py`);
|
||
- no output line contains `node20`.
|
||
|
||
Last verified clean: 2026-08-07 (all pins node24/composite — see plan.md
|
||
target table).
|