feat: add github_ref constraint on import-schema inputs with action pin resolution#29236
Open
feat: add github_ref constraint on import-schema inputs with action pin resolution#29236
Conversation
…in resolution Add a new `github_ref: true/false` constraint to import-schema input definitions (string and string[] types). When enabled: - Values are validated as owner/repo[@ref] or owner/repo/path[@ref] format - The compiler resolves and pins references through the action pin manager - Produces repo@sha # version pinned references for supply-chain security Files changed: - pkg/workflow/inputs.go: GitHubRef field on InputDefinition - pkg/parser/import_processor.go: GitHubRef field on ImportInputDefinition - pkg/parser/import_cache.go: GitHubRefPinner interface + Pinner field - pkg/parser/github_ref_input.go: Parse/validate/reconstruct helpers - pkg/parser/import_field_extractor.go: Validate + pin github_ref inputs - pkg/parser/import_bfs.go: Set pinner from cache on accumulator - pkg/parser/schemas/main_workflow_schema.json: Allow github_ref property - pkg/workflow/github_ref_pinner.go: PinContext-backed pinner implementation - pkg/workflow/compiler_orchestrator_engine.go: Attach pinner to import cache - .github/workflows/shared/apm.md: Enable github_ref: true on packages items Agent-Logs-Url: https://github.com/github/gh-aw/sessions/87a9603c-0863-47dc-82b6-73af97a35f3b Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/87a9603c-0863-47dc-82b6-73af97a35f3b Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
pelikhan
April 30, 2026 02:42
View session
Collaborator
|
@copilot recompile |
Contributor
🧪 Test Quality Sentinel ReportTest Quality Score: 80/100✅ Excellent test quality
Test Classification DetailsView All 9 Tests
Observations
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an opt-in github_ref constraint for import-schema string and string-array inputs, validating owner/repo[@ref] / owner/repo/path[@ref] shapes and (optionally) pinning them via the action pin manager during compilation.
Changes:
- Extends import input definitions and JSON schema with
github_ref: boolean. - Adds parser helpers for validating/parsing/reconstructing GitHub ref inputs and pins matching import inputs before substitution.
- Wires a
GitHubRefPinnerinto import processing (compiler → import cache → import accumulator) and adds tests + updates APM shared workflow schema usage.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/inputs.go | Adds GitHubRef to the unified input definition parsing/logging. |
| pkg/parser/import_processor.go | Adds GitHubRef field to the import input definition type. |
| pkg/parser/import_cache.go | Introduces GitHubRefPinner interface and adds optional Pinner to ImportCache. |
| pkg/parser/import_bfs.go | Passes cache pinner into the import accumulator. |
| pkg/parser/import_field_extractor.go | Validates github_ref strings, pins matching inputs before substitution, and adds helper functions. |
| pkg/parser/github_ref_input.go | Adds validation/parsing/reconstruction helpers for github_ref values. |
| pkg/workflow/github_ref_pinner.go | Implements a compiler-backed GitHubRefPinner using actionpins.PinContext. |
| pkg/workflow/compiler_orchestrator_engine.go | Attaches the pinner to the shared import cache before import processing. |
| pkg/parser/schemas/main_workflow_schema.json | Adds github_ref to the import-schema JSON schema (both scalar and array-item schema). |
| .github/workflows/shared/apm.md | Enables github_ref: true for APM package list items and updates description accordingly. |
| pkg/parser/github_ref_input_test.go | Unit tests for validate/parse/reconstruct helpers. |
| pkg/parser/github_ref_resolve_test.go | Unit tests for pre-substitution pinning behavior using a mock pinner. |
| pkg/workflow/import_schema_test.go | Integration coverage ensuring valid/invalid github_ref inputs pass/fail compilation. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 13/13 changed files
- Comments generated: 4
Comment on lines
+11
to
+14
| // path is an optional /… suffix of one or more path segments. | ||
| // ref is an optional @<ref> suffix where ref may be a tag, branch, or SHA. | ||
| var githubRefPattern = regexp.MustCompile( | ||
| `^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+(?:/[a-zA-Z0-9._-][a-zA-Z0-9._/\-]*)?(?:@[a-zA-Z0-9._/\-]+)?$`, |
Comment on lines
+821
to
+835
| func pinGitHubRefArray(arr []any, pinner GitHubRefPinner) []any { | ||
| result := make([]any, len(arr)) | ||
| changed := false | ||
| for i, item := range arr { | ||
| str, ok := item.(string) | ||
| if !ok { | ||
| result[i] = item | ||
| continue | ||
| } | ||
| pinned := pinner.PinGitHubRef(str) | ||
| result[i] = pinned | ||
| if pinned != str { | ||
| changed = true | ||
| } | ||
| } |
Comment on lines
+790
to
+792
| if !ok || !isGitHubRefParam(itemsDef) { | ||
| continue | ||
| } |
Comment on lines
+143
to
+147
| // Attach a GitHub ref pinner to the import cache so that import-schema | ||
| // inputs with github_ref: true are pinned at compile time. | ||
| if importCache.Pinner == nil { | ||
| importCache.Pinner = c.newImportCacheGitHubRefPinner() | ||
| } |
…ning Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
Commit pushed:
|
Contributor
Author
Recompiled — all 205 workflows compiled successfully, lock files are already up to date. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot smoke-Claude uses apm and it should have pinned its package |
…d pins Add ResolveLatestTag to ActionResolver and a fallback in PinGitHubRef so repos not in action_pins.json (e.g. microsoft/apm-sample-package) are pinned via the GitHub releases API when auth is available. Also extract defaultAPITimeout constant and add 6 unit tests covering the fallback path, subpath preservation, error handling, and the invariant that embedded-pin repos skip the fallback entirely. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/4de43e0a-afc9-433d-9036-4d70e73e3e1a Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed in 893e2e0. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Collaborator
|
@copilot if auth is unavailable, try Public APIs without auth |
…navailable When gh CLI auth is not configured (no GH_TOKEN / GITHUB_TOKEN), both the latest-release tag lookup and the tag->SHA resolution now fall back to unauthenticated calls to api.github.com. This makes github_ref pinning work for public repos like microsoft/apm-sample-package even in CI environments with no GitHub token. - queryLatestReleaseTag: gh CLI first, then public REST API - resolveFromGitHub: gh CLI first, then resolveTagSHAPublic (with annotated-tag peeling) via public REST API - Add queryLatestReleaseTagPublicFromURL + fetchGitObjectPublic helpers for testability; cover both with httptest-based unit tests Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e2b74a72-4885-4ce0-8acb-50cbc27b7d40 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in f3ef750. Both the tag-name lookup and the tag→SHA resolution now try Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds support for a new
github_ref: true/falseconstraint onimport-schemainput types (stringandstring[]). When enabled, entries must be parseable asowner/repo[@ref]orowner/repo/path[@ref](GitHub URL + ref shape), and the compiler resolves and pins those references through the action pin manager — treating them as action pins (producingrepo@sha # versionoutput).Changes
Core types
pkg/workflow/inputs.go: AddedGitHubRef boolfield toInputDefinitionpkg/parser/import_processor.go: AddedGitHubRef boolfield toImportInputDefinitionParser package
pkg/parser/import_cache.go: AddedGitHubRefPinnerinterface andPinnerfield toImportCachepkg/parser/github_ref_input.go(new): Helper functions —ValidateGitHubRefInput,ParseGitHubRefParts,ReconstructGitHubRefValuepkg/parser/import_field_extractor.go:github_refformat invalidateImportInputType(for string type)resolveGitHubRefInputsto pin values before expression substitutionisGitHubRefParam,pinGitHubRefValue,pinGitHubRefArray,copyInputshelperspkg/parser/import_bfs.go: Set pinner fromcache.Pinneron the import accumulatorWorkflow compiler
pkg/workflow/github_ref_pinner.go(new):pinContextGitHubRefPinnerbacked byactionpins.PinContextwith dynamic resolver support, including alatestTagResolverfallback interface for repos not in embedded action pinspkg/workflow/action_resolver.go: AddedResolveLatestTag(repo)toActionResolverwith a three-tier resolution strategy; extracteddefaultAPITimeoutconstant shared across all API callspkg/workflow/compiler_orchestrator_engine.go: Attaches aGitHubRefPinnerto the import cache before processing importsJSON schema
pkg/parser/schemas/main_workflow_schema.json: Addedgithub_refboolean property to both the scalar input definition and theitemssub-schemaWorkflow upgrade
.github/workflows/shared/apm.md: Addedgithub_ref: truetopackages.items— APM package references are now validated asowner/repoorowner/repo/pathformat and pinned at compile timeTests
pkg/parser/github_ref_input_test.go—ValidateGitHubRefInput,ParseGitHubRefParts,ReconstructGitHubRefValuepkg/parser/github_ref_resolve_test.go—resolveGitHubRefInputswith a mock pinnerpkg/workflow/import_schema_test.go—TestImportSchemaGitHubRef(valid strings, valid arrays, invalid format rejection, array item validation)pkg/workflow/github_ref_pinner_test.go(new) —PinGitHubRefunit tests: latest-tag fallback success, subpath preservation, error graceful degradation, nil resolver, explicit-ref skips fallback, embedded-pin repos skip fallbackpkg/workflow/action_resolver_test.go—TestFetchGitObjectPublic,TestQueryLatestReleaseTagPublic(httptest-based, no network)Design notes
github_refis opt-in; existing import-schema definitions are unaffectednilpinner skips resolution entirely (used in parser-only contexts)resolveGitHubRefInputsis called after defaults are applied but beforesubstituteImportInputsInContent, so pinned values flow naturally through the template engineaction_pins.json(fast, no network) — used for known GitHub Actionsgh apicall (requiresGH_TOKEN/GITHUB_TOKEN) — queries/repos/{owner}/{repo}/releases/latestthen resolves the tag to a commit SHAhttps://api.github.com) — fallback for public repos when no token is configured; supports full annotated-tag peeling