Repository navigation
feat: add optional actions-lock integration to compile - #72395
Conversation
Add compile --actions-lock to invoke gh actions-lock --no-narrow after successful compilation without installing the extension. Preserve JSON output and reject incompatible emission/watch modes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Cover explicit and origin-detected hosts, enterprise credentials, public fallback tokens, GitHub token precedence, and inherited configuration and certificate settings. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Commit pushed:
|
🏗️ Design Decision Gate — ADR RequiredThis PR makes significant changes to core business logic (270 new lines in 📄 Draft ADR committed: Decision captured: add an opt-in
📋 What to do next
Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision. ❓ Why ADRs Matter
ADRs create a searchable, permanent record of why the codebase looks the way it does. 📋 Michael Nygard ADR Format ReferenceAn ADR must contain these four sections to be considered complete:
All ADRs are stored in
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review summary
No actionable blocking issues found in the changed lines. The implementation correctly gates the optional extension, preserves JSON stdout by forwarding extension output to stderr, validates incompatible modes, runs from the repository root, and propagates failures. Static review only; the specialist pass was unavailable because its diff-read tool invocation was denied.
🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~2 AIC · ⌖ ~1 AIC · ⊞ 1.6K
Comment /review to run again
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /tdd and /codebase-design — requesting changes on a validation gap that lets --dry-run --actions-lock mutate the real repository lockfile.
📋 Key Themes & Highlights
Key Themes
- Validation gap (primary): validateCompileConfig rejects --actions-lock combined with --no-emit/--read-only/--watch, but not --dry-run. Since dry-run already forces lock-file emission, this combo would invoke the live gh actions-lock --no-narrow extension during what the compiler documents as a mutation-free dry run (dryRunScopeMessage). Flagged as inline comments on compile_validation.go and the missing regression test in compile_actions_lock_test.go.
- Architectural divergence: ActionsLock is wired as a single top-level post-compile hook in CompileWorkflows, while the existing Dependabot flag lives inside the per-pipeline runPostProcessing* functions. Non-blocking, but worth a note so the post-compile side effect placement question does not fork further.
Positive Highlights
- ✅ Strong test coverage overall: flag plumbing, success/failure paths, missing-extension guidance, JSON/stderr output isolation, repo-root execution, and enterprise env forwarding are all exercised with fake gh scripts.
- ✅ Clear, actionable error message when the gh-actions-lock extension is not installed.
- ✅ Careful isolation of extension output to stderr so --json stdout stays parseable.
Note: triage via the pr-triage agent recommended /tdd and /grill-with-docs; I additionally applied /codebase-design given the orchestration-placement question, and prioritized the dry-run safety gap as the highest-impact, concrete finding.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · ~151 AIC · ⌖ ~17 AIC · ⊞ 10.2K
Comment /matt to run again
There was a problem hiding this comment.
🟡 Changes recommended
The repository-root regression test can fail on symlinked temporary directories because it compares logical and physical paths.
1 open issue
What changed in this PR
Adds optional Actions dependency locking to gh aw compile while preserving gh-aw’s existing action-pin cache and ordinary compilation behavior.
Changes:
- Adds
--actions-lockto run the separately installed extension after successful compilation. - Preserves subprocess environment settings and JSON output, and rejects incompatible compile modes.
- Documents the integration and adds flag, execution, failure, and enterprise-environment coverage.
| File | Description |
|---|---|
pkg/cli/compile_validation.go |
Rejects incompatible flag combinations. |
pkg/cli/compile_orchestrator.go |
Runs the extension from the repository root after compilation. |
pkg/cli/compile_config.go |
Adds the actions-lock configuration option. |
pkg/cli/compile_actions_lock_test.go |
Covers extension execution, failures, environment forwarding, and cancellation. |
docs/src/content/docs/setup/cli.md |
Documents installation, behavior, and restrictions. |
cmd/gh-aw/main.go |
Registers the flag and forwards its value. |
cmd/gh-aw/compile_flags_test.go |
Verifies the flag default and configuration plumbing. |
Review effort: Max
Reject extension post-processing during dry-run, cover lockfile preservation, document once-per-run ordering, and finalize the proposed ADR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
In response to #72395 (comment): completed the ADR's context, alternatives, consequences, and remaining limitations in 0f9f282. The finalized ADR is now linked in the PR description. |
|
In response to #72395 (comment): reviewed and completed the generated ADR in 0f9f282. Its status remains Proposed pending review of this PR. |
|
🎉 This pull request is included in a new release. Release: |
Summary
Allow users to maintain the standard Actions dependency lockfile during compilation without replacing gh-aw's existing pin cache or requiring the extension for ordinary compilation.
gh aw compile --actions-lockto invokegh actions-lock --no-narrowfrom the repository root after successful compilation and companion workflow generation. The extension scans its default workflow directory, including when compiling specific files.--no-emit,--read-only,--watch, and--dry-run. Dry-run compilation still intentionally emits compiler files; broader extension-owned post-processing is excluded.The existing
.github/aw/actions-lock.jsonand action pin resolution remain in place. This is a scoped first step toward #70264, not a complete resolution.ADR: ADR-72395: Delegate Actions Lockfile Maintenance to the gh-actions-lock Extension
Validation
make buildandmake fmtpassed.make check-workflow-driftpassed for all 349 workflows, including after the review fixes.BASE_REF=HEAD make agent-report-progress-no-testpassed for the enterprise follow-up before its commit.make agent-report-progressran impacted tests successfully but was blocked by pre-existing custom-linter findings in unchanged functions. The review-batch no-test gate likewise reports only the existing function-length findings inCompileWorkflowWithValidationandCompileWorkflowDataWithValidation; standard Go lint and schema freshness passed.