feat: add options to load the action from a specific repo/ref #77
Conversation
aduh95
changed the title
| type: string | ||
|
|
||
| action-repository: | ||
| description: "Repository to load the actions from" |
There was a problem hiding this comment.
why would we want the repository to be overrideable?
There was a problem hiding this comment.
In the case of forks. I've used it to test this very PR
|
|
||
| action-ref: | ||
| description: "Git ref to load the actions from" | ||
| default: ${{ github.ref || 'v0.1.10' }} |
There was a problem hiding this comment.
There's a version script at the root that used to update this version during npm version: https://github.com/pkgjs/action/blob/main/package.json#L9 - not sure what's the best approach for it now.
There was a problem hiding this comment.
Additionally, when would github.ref not be set?
There was a problem hiding this comment.
Additionally, when would
github.refnot be set?
As the docs say: This is only set if a branch or tag is available for the event type.
From my own testing, workflow_call leaves this undefined, although couldn't find where that's defined in the docs.
|
|
||
| action-repository: | ||
| description: "Repository to load the actions from" | ||
| default: ${{ github.repository || 'pkgs/action' }} |
There was a problem hiding this comment.
What does github.repository refer to here? Would that not be the repository that sets uses: pkgjs/action, i.e. it will always try to check out the local copy (which probably won't exist), rather than the pkgjs/action itself?
I could be misinterpreting this, of course.
Additionally, when would github.repository not be set at all?
There was a problem hiding this comment.
What does
github.repositoryrefer to here?
On workflow_call: it's undefined. Otherwise, it's the name of the repo, as you can see in https://github.com/aduh95/action/actions/runs/15821306998, it takes the name of the fork.
3 participants
See https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
Tested with https://github.com/nodejs/node-core-utils/actions/runs/15667322080/job/44133183235
It allows to use the action from a fork / on a specific commit. It shouldn't be a breaking change as the default is left unchanged.