ci(actions): add workflow dependency lockfile - #774

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch ci/actions-lock → main

View scan in OX Security →

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.
see 1 file with indirect coverage changes

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

PR Review: Workflow Dependency Lockfile

Comprehensive review of PR #774 completed according to Aignostics Python SDK standards.

✅ CRITICAL CHECKS — All Passed

1. Test Markers

Status: ✅ N/A
No test files changed in this PR.

2. Test Coverage

Status: ✅ Pass
Codecov reports: "All modified and coverable lines are covered by tests. All tests successful."

3. Code Quality

Status: ✅ Pass

• No code changes to lint
• Workflow YAML syntax is valid
• Changes are purely infrastructure improvements

4. Conventional Commits

Status: ✅ Pass

94487a8 ci(actions): add workflow dependency lockfile

Follows type(scope): description format correctly.

📋 Repository-Specific Review

5. Architecture Compliance

Status: ✅ N/A
Infrastructure change only, no modulith architecture impact.

6. Testing Strategy

Status: ✅ N/A
No test changes.

7. Medical Device & Security

Status: ✅ SECURITY ENHANCEMENT

This PR significantly improves security posture by:

• Pinning all GitHub Actions to full commit SHAs (including transitive dependencies)
• Meeting organizational security requirements for action pinning
• Preventing supply chain attacks via compromised action tags
• Providing machine-verified lockfile coverage for all 28 workflows

Changes verified:

- uses: ./.github/actions/run-tests
+ uses: $/.github/actions/run-tests

The $/ syntax is GitHub's documented way to reference local actions at the running commit, enabling the lockfile to lock transitive dependencies that the local action uses. See: https://docs.github.com/en/actions/sharing-automations/creating-actions/about-custom-actions#using-release-management-for-actions

Lockfile structure verified:

• Machine-generated by gh actions-lock v0.4.1
• Covers all workflows in .github/workflows/
• All actions pinned to full 40-character commit SHAs
• Format follows GitHub's lockfile spec v0.0.3

8. Breaking Changes

Status: ✅ None
The ./ to $/ syntax change is transparent to workflow execution. Both syntaxes work identically for local actions; $/ simply enables better lockfile tracking.

9. CI/CD Impact

Status: ✅ Positive Impact

Workflows affected (verified by diff):

• .github/workflows/_scheduled-test-daily.yml (5 occurrences)
• .github/workflows/_test.yml (5 occurrences)

Both workflows correctly changed all references to the run-tests local action.

Verification completed:

• ✅ Author confirmed: gh actions-lock --verify-local passes (28 workflows covered)
• ✅ Author confirmed: gh actions-lock --verify passes locally
• ✅ Diff contains only the expected ./ → $/ changes
• ✅ All automated CI checks passing (OX Security, SonarQube, Codecov)

Future maintenance:
PR description states: "Renovate updates the lockfile in its own PRs" — confirms automation is in place.

10. Documentation Updates

Status: ⚠️ Suggestion (Non-Blocking)

Finding: .github/CLAUDE.md does not mention workflow dependency lockfiles.

Recommendation: Add a section to .github/CLAUDE.md documenting:

1. Purpose of actions.lock
2. How to update it when adding/changing actions (gh actions-lock)
3. Renovate automation for lockfile maintenance
4. The $/ vs ./ syntax requirement for local actions

Suggested location: After the "Workflow layout" section in .github/CLAUDE.md

Example content:

## Workflow Dependency Lockfile

The repository uses `actions.lock` to pin all GitHub Actions (including transitive dependencies) to commit SHAs, meeting organizational security requirements.

**Maintaining the lockfile:**
- Regenerate after adding/modifying actions: `gh actions-lock --no-interactive --migrate-local-actions --no-narrow`
- Verify coverage: `gh actions-lock --verify-local`
- Renovate automatically updates the lockfile in dependency PRs

**Local action syntax:**  
Use `uses: $/.github/actions/<name>` (not `uses: ./.github/actions/<name>`) to enable lockfile tracking of actions that your local actions use.

Docs: https://docs.github.com/en/actions/concepts/security/workflow-dependency-lockfiles

📊 Summary

Blocking Issues: None ✅

Suggestions:

1. Add lockfile documentation to .github/CLAUDE.md (non-blocking)

Overall Assessment:
This is an excellent security improvement that:

• Meets organizational compliance requirements
• Follows GitHub's documented best practices
• Has minimal code impact (10 lines changed)
• Is properly automated via Renovate
• Passed comprehensive verification

The changes are clean, well-documented in the PR description, and all automated checks pass. The author has done thorough verification work.

Recommendation: ✅ APPROVE with optional documentation enhancement.

Verdict: ✅ claude:review:passed

View job run