{{ message }}
Repository navigation
relock: convert to composite action, build from source - #65
Merged
Merged
Conversation
nodeselector
force-pushed
the
nodeselector-dependabot-relock-workflow
branch
from
June 25, 2026 12:45
6bb1259 to
274abcc
Compare
There was a problem hiding this comment.
⚠️ Not ready to approve
The new composite action’s token input documentation is inconsistent with how the token is actually used (it does not affect the git push step).
Pull request overview
Converts the relock automation to follow the same “build from source” composite-action pattern used by the existing lint action, avoiding cross-repo gh extension install token/permission pitfalls and centralizing relock logic.
Changes:
- Adds a new
actions/relockcomposite action that sets up goproxy, buildsgh-actions-lock, relocks, and commits/pushes updates. - Updates the reusable relock workflow to delegate to the composite action (and requests
id-token: write). - Updates
actions.lockto reflect the new workflow dependency.
File summaries
Review details
- Files reviewed: 2/3 changed files
- Comments generated: 1
- Review effort level: Low
Note
Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
nodeselector
force-pushed
the
nodeselector-dependabot-relock-workflow
branch
from
June 25, 2026 12:48
274abcc to
b1bd312
Compare
nodeselector
force-pushed
the
nodeselector-dependabot-relock-workflow
branch
from
June 25, 2026 12:53
b1bd312 to
0934195
Compare
nodeselector
force-pushed
the
nodeselector-dependabot-relock-workflow
branch
from
June 25, 2026 12:57
0934195 to
effca6f
Compare
nodeselector
force-pushed
the
nodeselector-dependabot-relock-workflow
branch
from
June 25, 2026 12:58
effca6f to
1a7866c
Compare
nodeselector
force-pushed
the
nodeselector-dependabot-relock-workflow
branch
from
June 25, 2026 13:05
1a7866c to
31922c2
Compare
Same pattern as the lint action — avoids gh extension install cross-repo token issues. Reusable workflow now delegates to the composite action.
nodeselector
force-pushed
the
nodeselector-dependabot-relock-workflow
branch
from
June 25, 2026 13:11
31922c2 to
d65486d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same pattern as the lint action — builds gh-actions-lock from source to avoid cross-repo
gh extension installtoken issues.actions/relockcomposite action (goproxy + go build + relock + commit/push)id-token: writefor goproxy OIDC