Skip to content

Commit 35da39b

Browse files
CopilotCopilot
authored
fix: SHA-pin the runtime setup-cli step emitted for custom steps: workflows (#38344)
1 parent 803077c commit 35da39b

6 files changed

Lines changed: 53 additions & 12 deletions

‎pkg/workflow/compiler_yaml_main_job.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ func (c *Compiler) generateRuntimeAndWorkspaceSetupSteps(yaml *strings.Builder,
222222
}
223223

224224
// Generate runtime setup steps (after filtering out user-customized ones)
225-
runtimeSetupSteps := GenerateRuntimeSetupSteps(runtimeRequirements)
225+
runtimeSetupSteps := GenerateRuntimeSetupSteps(runtimeRequirements, data)
226226
compilerYamlLog.Printf("Detected runtime requirements: %d runtimes, %d setup steps", len(runtimeRequirements), len(runtimeSetupSteps))
227227

228228
// Decision logic for where to place runtime steps:

‎pkg/workflow/runtime_definitions.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ var knownRuntimes = []*Runtime{
9595
ID: "gh-aw",
9696
Name: "gh-aw CLI",
9797
ActionRepo: "github/gh-aw/actions/setup-cli",
98-
ActionVersion: "v0.72.1",
98+
ActionVersion: "", // Derived at compile time from the compiler version; see runtime_step_generator.go
9999
VersionField: "version",
100100
// Default version is computed at generation time from the current gh-aw build.
101101
DefaultVersion: "",

‎pkg/workflow/runtime_gh_aw_test.go‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
package workflow
44

55
import (
6+
"context"
67
"strings"
78
"testing"
89

@@ -104,7 +105,7 @@ func TestGenerateRuntimeSetupSteps_GhAw_DevBuildsFromSource(t *testing.T) {
104105
steps := GenerateRuntimeSetupSteps([]RuntimeRequirement{{
105106
Runtime: ghAwRuntime,
106107
Version: "",
107-
}})
108+
}}, nil)
108109
require.NotEmpty(t, steps)
109110

110111
content := strings.Join(steps[0], "\n")
@@ -134,10 +135,44 @@ func TestGenerateRuntimeSetupSteps_GhAw_ReleaseUsesSetupCLI(t *testing.T) {
134135
steps := GenerateRuntimeSetupSteps([]RuntimeRequirement{{
135136
Runtime: ghAwRuntime,
136137
Version: "",
137-
}})
138+
}}, nil)
138139
require.NotEmpty(t, steps)
139140

140141
content := strings.Join(steps[0], "\n")
141142
assert.Contains(t, content, "uses: github/gh-aw/actions/setup-cli@")
142143
assert.Contains(t, content, "version: 'v0.72.1'")
143144
}
145+
146+
func TestGenerateRuntimeSetupSteps_GhAw_ReleaseUsesWorkflowDataPin(t *testing.T) {
147+
originalVersion := GetVersion()
148+
originalRelease := IsRelease()
149+
t.Cleanup(func() {
150+
SetVersion(originalVersion)
151+
SetIsRelease(originalRelease)
152+
})
153+
154+
SetVersion("v0.72.1")
155+
SetIsRelease(true)
156+
157+
ghAwRuntime := findRuntimeByID("gh-aw")
158+
require.NotNil(t, ghAwRuntime)
159+
160+
cache := NewActionCache(t.TempDir())
161+
sha := "0123456789abcdef0123456789abcdef01234567"
162+
cache.Set("github/gh-aw/actions/setup-cli", "v0.72.1", sha)
163+
164+
data := &WorkflowData{
165+
Ctx: context.Background(),
166+
ActionResolver: NewActionResolver(cache),
167+
}
168+
169+
steps := GenerateRuntimeSetupSteps([]RuntimeRequirement{{
170+
Runtime: ghAwRuntime,
171+
Version: "",
172+
}}, data)
173+
require.NotEmpty(t, steps)
174+
175+
content := strings.Join(steps[0], "\n")
176+
assert.Contains(t, content, "uses: github/gh-aw/actions/setup-cli@"+sha)
177+
assert.Contains(t, content, "version: 'v0.72.1'")
178+
}

‎pkg/workflow/runtime_integration_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -504,7 +504,7 @@ func TestRuntimeIfConditionIntegration(t *testing.T) {
504504
reqSlice = append(reqSlice, *req)
505505
}
506506

507-
steps := GenerateRuntimeSetupSteps(reqSlice)
507+
steps := GenerateRuntimeSetupSteps(reqSlice, nil)
508508
allSteps := ""
509509
for _, step := range steps {
510510
for _, line := range step {

‎pkg/workflow/runtime_setup_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -456,7 +456,7 @@ func TestGenerateRuntimeSetupSteps(t *testing.T) {
456456

457457
for _, tt := range tests {
458458
t.Run(tt.name, func(t *testing.T) {
459-
steps := GenerateRuntimeSetupSteps(tt.requirements)
459+
steps := GenerateRuntimeSetupSteps(tt.requirements, nil)
460460

461461
if len(steps) != tt.expectSteps {
462462
t.Errorf("Expected %d steps, got %d", tt.expectSteps, len(steps))
@@ -917,7 +917,7 @@ func TestGenerateRuntimeSetupStepsWithIfCondition(t *testing.T) {
917917

918918
for _, tt := range tests {
919919
t.Run(tt.name, func(t *testing.T) {
920-
steps := GenerateRuntimeSetupSteps(tt.requirements)
920+
steps := GenerateRuntimeSetupSteps(tt.requirements, nil)
921921

922922
if len(steps) != tt.expectSteps {
923923
t.Errorf("Expected %d steps, got %d", tt.expectSteps, len(steps))

‎pkg/workflow/runtime_step_generator.go‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,19 @@ import (
1010

1111
var runtimeStepGeneratorLog = logger.New("workflow:runtime_step_generator")
1212

13-
// GenerateRuntimeSetupSteps creates GitHub Actions steps for runtime setup
14-
func GenerateRuntimeSetupSteps(requirements []RuntimeRequirement) []GitHubActionStep {
13+
// GenerateRuntimeSetupSteps creates GitHub Actions steps for runtime setup.
14+
// data is the WorkflowData for the workflow being compiled; it is forwarded to
15+
// generateSetupStep so that the gh-aw setup-cli step can use the lock-file-aware
16+
// pin resolver (getActionPinWithData) rather than the static embedded-pins fallback.
17+
// Pass nil only when WorkflowData is unavailable or when tests specifically
18+
// target non-gh-aw runtime behavior.
19+
func GenerateRuntimeSetupSteps(requirements []RuntimeRequirement, data *WorkflowData) []GitHubActionStep {
1520
runtimeStepGeneratorLog.Printf("Generating runtime setup steps: requirement_count=%d", len(requirements))
1621
runtimeSetupLog.Printf("Generating runtime setup steps for %d requirements", len(requirements))
1722
var steps []GitHubActionStep
1823

1924
for _, req := range requirements {
20-
steps = append(steps, generateSetupStep(&req))
25+
steps = append(steps, generateSetupStep(&req, data))
2126

2227
// Add environment variable capture steps after setup actions for AWF chroot mode.
2328
// Most env vars are inherited via AWF_HOST_PATH, but Go is special.
@@ -50,7 +55,7 @@ func generateEnvCaptureStep(envVar string, captureCmd string) GitHubActionStep {
5055
}
5156

5257
// generateSetupStep creates a setup step for a given runtime requirement
53-
func generateSetupStep(req *RuntimeRequirement) GitHubActionStep {
58+
func generateSetupStep(req *RuntimeRequirement, data *WorkflowData) GitHubActionStep {
5459
runtime := req.Runtime
5560
version := req.Version
5661
runtimeStepGeneratorLog.Printf("Generating setup step for runtime: %s, version=%s, if=%s", runtime.ID, version, req.IfCondition)
@@ -74,7 +79,8 @@ func generateSetupStep(req *RuntimeRequirement) GitHubActionStep {
7479
ifCondition: req.IfCondition,
7580
cliVersion: version,
7681
actionRepo: runtime.ActionRepo,
77-
fallbackActionRefTag: runtime.ActionVersion,
82+
fallbackActionRefTag: version,
83+
workflowData: data,
7884
withFields: allExtraFields,
7985
})
8086
if err != nil {

0 commit comments

Comments
 (0)