From cb91f99c0599e8d7b7aa006db3b66429e6857c50 Mon Sep 17 00:00:00 2001 From: Felix Stubner Date: Fri, 28 Aug 2026 16:39:56 +0100 Subject: [PATCH] Submit the right version to winget, and pin the rest of the actions Both winget jobs would have submitted `PackageVersion: v0.3.1` beside the existing `0.3.0` in the catalog. The action strips the tag's `v` only when the `version` input is empty -- from its own action.yml: If ('' -eq '${{ inputs.version }}') { tag_name -replace '^v' } Else { inputs.version } Passing `${{ env.TAG }}` opted out of that. Winget sorts versions naturally, so `v0.3.1` and `0.3.0` do not compare as an upgrade. A step now derives the stripped form and both jobs use it. The same two jobs also left `release-tag` at its default, which is `github.event.release.tag_name || github.ref_name`. On a `workflow_dispatch` the first is null and the second is the branch the run was dispatched from, so the action would ask the API for a release tagged `main` -- on exactly the re-run path this workflow's header offers for recovering a failed publish. Both jobs now name the tag. Neither was reachable before now: the winget GUI job has never run to completion (it needs microsoft/winget-pkgs to accept an initial submission first), and the committed 0.3.0 manifests were written by hand. Separately, the first-party `actions/*` steps are now SHA-pinned like every third-party action already was. publish.yml, release.yml and release-drafter.yml were fully pinned; ci.yml, site.yml, site-preview.yml, pages.yml, audit.yml and gui-render.yml were not, which left the policy looking deliberate in three files and absent in six. 28 uses across six workflows, each carrying the resolved version in a trailing comment. All nine workflow files parse. --- .github/workflows/audit.yml | 4 +-- .github/workflows/ci.yml | 22 ++++++++--------- .github/workflows/gui-render.yml | 4 +-- .github/workflows/pages.yml | 10 ++++---- .github/workflows/publish.yml | 39 ++++++++++++++++++++++++++++-- .github/workflows/site-preview.yml | 6 ++--- .github/workflows/site.yml | 10 ++++---- 7 files changed, 65 insertions(+), 30 deletions(-) diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 3adc872c..022c6209 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -37,7 +37,7 @@ jobs: name: cargo audit runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust # See ci.yml's lint job for why this pin keeps a `# stable` comment @@ -53,7 +53,7 @@ jobs: # Cache cargo-audit itself so we don't reinstall every run. - name: Cache cargo-audit id: cache-cargo-audit - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cargo/bin/cargo-audit key: cargo-audit-v1 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1c317a49..0ae0bd1e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -63,7 +63,7 @@ jobs: outputs: code: ${{ steps.filter.outputs.code }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - id: filter @@ -107,8 +107,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: # 22, matching pages.yml / release.yml / site.yml / site-preview.yml. # Node 20 left standard support in April 2026, and the split meant @@ -127,7 +127,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # install.sh is user-facing; the release/ scripts hold GH_TOKEN and # push to three package registries. Both are worth linting, and # neither is exercised by any other job. @@ -166,7 +166,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # libpcap-dev: netscli-core pcap feature. GTK/WebKit: netscli-gui # (Tauri 2) — clippy --all-targets compiles the Tauri shell, which # won't link without these even when we only intend to lint Rust. @@ -211,7 +211,7 @@ jobs: matrix: os: [ubuntu-latest, macos-latest, windows-latest] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Linux needs libpcap for netscli-core's pcap feature and GTK/WebKit # for netscli-gui (Tauri 2). `cargo test --all` compiles the whole @@ -253,8 +253,8 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: # 22 — see the note on the maintainability job. This one is also # load-bearing for jsdom: jsdom 30 pulls an undici that calls @@ -309,7 +309,7 @@ jobs: matrix: os: ${{ github.event_name == 'pull_request' && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "windows-latest", "macos-latest"]') }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install system dependencies (Linux) if: runner.os == 'Linux' run: | @@ -326,7 +326,7 @@ jobs: - name: cargo build --release -p netscli run: cargo build --release -p netscli - name: Upload artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: netscli-${{ matrix.os }} path: | @@ -359,7 +359,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install system dependencies run: | sudo apt-get update diff --git a/.github/workflows/gui-render.yml b/.github/workflows/gui-render.yml index e35ca847..13d4067b 100644 --- a/.github/workflows/gui-render.yml +++ b/.github/workflows/gui-render.yml @@ -65,7 +65,7 @@ jobs: runs-on: windows-latest timeout-minutes: 30 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Rust # See ci.yml's lint job for why this pin keeps a `# stable` comment @@ -78,7 +78,7 @@ jobs: with: shared-key: gui-render-windows - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: # 22, matching ci.yml and the release build. See ci.yml's note. node-version: 22 diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 8255fc55..ea2a8d6f 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -33,8 +33,8 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: # Astro 6 requires Node >=22.12. Pinning to 22 (active LTS). node-version: 22 @@ -46,9 +46,9 @@ jobs: - name: astro build run: npm run build working-directory: site - - uses: actions/configure-pages@v6 + - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload site/dist/ - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: site/dist @@ -61,4 +61,4 @@ jobs: steps: - name: Deploy id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index e5b2dab0..02a73067 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -180,11 +180,35 @@ jobs: echo "asset never appeared after 15 minutes" >&2 exit 1 + # `version` is the PackageVersion that lands in the catalog, and it must + # not carry the tag's `v`. The action strips it only when the input is + # empty -- its own source reads + # + # If ('' -eq '${{ inputs.version }}') { tag_name -replace '^v' } + # Else { inputs.version } + # + # -- so passing `${{ env.TAG }}` opted out of the stripping and would + # have submitted `v0.3.1` beside the existing `0.3.0`. Winget sorts + # versions naturally, so the two do not compare as an upgrade. + - name: Resolve PackageVersion (tag without the leading v) + id: pkg + shell: bash + env: + TAG: ${{ env.TAG }} + run: echo "version=${TAG#v}" >> "$GITHUB_OUTPUT" + - name: Submit netscli to microsoft/winget-pkgs uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2 with: identifier: fstubner.netscli - version: ${{ env.TAG }} + version: ${{ steps.pkg.outputs.version }} + # `release-tag` defaults to + # `github.event.release.tag_name || github.ref_name`, and on a + # `workflow_dispatch` the first is null and the second is the branch + # the run was dispatched from. The action would then ask the API for + # a release tagged `main` and fail -- on precisely the re-run path + # this workflow's header offers for recovering a failed publish. + release-tag: ${{ env.TAG }} installers-regex: 'netscli-windows-x86_64\.exe$' token: ${{ secrets.WINGET_TOKEN }} @@ -368,11 +392,22 @@ jobs: echo "asset never appeared after 15 minutes" >&2 exit 1 + # Same two corrections as the CLI winget job above: strip the `v` from + # the PackageVersion, and name the release tag explicitly so a + # `workflow_dispatch` re-run does not look for a release tagged `main`. + - name: Resolve PackageVersion (tag without the leading v) + id: pkg + shell: bash + env: + TAG: ${{ env.TAG }} + run: echo "version=${TAG#v}" >> "$GITHUB_OUTPUT" + - name: Submit netscli-gui to microsoft/winget-pkgs uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2 with: identifier: fstubner.netscli.gui - version: ${{ env.TAG }} + version: ${{ steps.pkg.outputs.version }} + release-tag: ${{ env.TAG }} installers-regex: 'netscli-gui-windows-x86_64\.msi$' token: ${{ secrets.WINGET_TOKEN }} diff --git a/.github/workflows/site-preview.yml b/.github/workflows/site-preview.yml index 1b219d78..57305df9 100644 --- a/.github/workflows/site-preview.yml +++ b/.github/workflows/site-preview.yml @@ -62,9 +62,9 @@ jobs: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 cache: npm @@ -146,7 +146,7 @@ jobs: - name: Comment the preview URL # Only a pull_request run has somewhere to put this. if: github.event_name == 'pull_request' && steps.deploy.outputs.url != '' - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: PREVIEW_URL: ${{ steps.deploy.outputs.url }} with: diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml index 5ab9f1eb..7dec0d68 100644 --- a/.github/workflows/site.yml +++ b/.github/workflows/site.yml @@ -30,7 +30,7 @@ jobs: outputs: site: ${{ steps.filter.outputs.site }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - id: filter @@ -64,8 +64,8 @@ jobs: if: needs.changes.outputs.site == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 - run: node scripts/check-file-size.mjs @@ -89,8 +89,8 @@ jobs: run: working-directory: site steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 cache: npm