dependabot-github_actions 0.400.0 → 0.402.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 127143db09496d31ce04baf778857fb6c24220b8281339e4e20d3b02952817a7
-  data.tar.gz: 57070b737dc53b4c2afb8304abfe3401afabd173d8c24d593f49803e7d43582d
+  metadata.gz: 2b4e91bfa491ff4e2ec830e11a36ede433981bb4eed911892731ee86c1524e5a
+  data.tar.gz: 72215130e11597be9306a4d06aaef10c14f23324b7c05e9a9ede16ab407c8a8c
 SHA512:
-  metadata.gz: 9c16394377ec48df4232a55acdc5f8af3705b4b91358630732d365084b44230ca1f6316b65e64f6f6b301ea3f73299798b87ada26f5fa2e9df184cc6770ed48b
-  data.tar.gz: cdf8bf664b45b30d395b842972bd6fb55693849f56cf54c679582cd0da682e5d25f4e85881f2b7844bf50b1fd90be7d4cec22b36cae76455e23190dac4c2ad9d
+  metadata.gz: 0de27643b909bdc0145989098cd705eec0c96cf3d3a78dcba5556c15c5db16b2542dfd2d6a82d1ac73f1d07d0a3321427cc9fad93c732fc4a079bd6efd3040ca
+  data.tar.gz: cd48b7b7093a9f6c4b8a607ff4607272e0b993206deafca33d1c72731365c2c6af0e569bb1254d287d96c8087bbb5ef0bfcc26ae1fc51165a370ea249509cac4

data/lib/dependabot/github_actions/constants.rb

@@ -23,6 +23,7 @@ module Dependabot
     MANIFEST_FILE_YML = "action.yml"
     # The name of the manifest file
     MANIFEST_FILE_YAML = "action.yaml"
+    ACTION_FILE_NAMES = T.let([MANIFEST_FILE_YML, MANIFEST_FILE_YAML].freeze, T::Array[String])
     # The pattern to match any .yml or .yaml file
     ANYTHING_YML = "<anything>.yml"
     # The path to the workflow directory
@@ -34,8 +35,9 @@ module Dependabot
     LOCKFILE_NAME = "actions.lock"
     # The repo-relative path to the Actions lockfile
     LOCKFILE_PATH = T.let("#{WORKFLOW_DIRECTORY}/#{LOCKFILE_NAME}".freeze, String)
-    # The only lockfile schema version this ecosystem understands.
-    SUPPORTED_LOCKFILE_VERSION = "v0.0.2"
+    # Lockfile schema versions this ecosystem understands. gh-actions-lock migrates
+    # v0.0.2 input and always writes v0.0.3.
+    SUPPORTED_LOCKFILE_VERSIONS = %w(v0.0.2 v0.0.3).freeze
 
     OWNER_KEY = "owner"
     REPO_KEY = "repo"

data/lib/dependabot/github_actions/file_fetcher.rb

@@ -1,12 +1,14 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "pathname"
 require "sorbet-runtime"
 
 require "dependabot/file_fetchers"
 require "dependabot/file_fetchers/base"
 require "dependabot/experiments"
 require "dependabot/github_actions/constants"
+require "dependabot/github_actions/workflow_file"
 
 module Dependabot
   module GithubActions
@@ -50,7 +52,7 @@ module Dependabot
           # and never activates the ecosystem on its own. Relocking also requires
           # every workflow to be materialized, so retain the workflow-only path if
           # an invalidly encoded workflow had to be omitted.
-          fetched_files += [actions_lockfile].compact if incorrectly_encoded_workflow_files.empty?
+          fetched_files += relock_files if incorrectly_encoded_workflow_files.empty?
           return fetched_files
         end
 
@@ -76,15 +78,84 @@ module Dependabot
 
       private
 
-      # Fetches the canonical `.github/workflows/actions.lock` when the update covers
-      # repository workflows. Composite-action directories cannot own a lockfile.
+      # The lockfile plus everything the engine needs to relock it, or nothing when
+      # a workflow it would read is invalidly encoded.
+      sig { returns(T::Array[DependencyFile]) }
+      def relock_files
+        lockfile = actions_lockfile
+        return [] unless lockfile && repository_workflow_files.all? { |f| f.content&.valid_encoding? }
+
+        [lockfile] + repository_workflow_files + self_repository_action_files
+      end
+
+      # Fetches the canonical `.github/workflows/actions.lock`. Composite-action
+      # directories cannot own a lockfile, but `$/` workflows reaching them do.
       sig { returns(T.nilable(DependencyFile)) }
       def actions_lockfile
         return unless Dependabot::Experiments.enabled?(:github_actions_lockfile)
-        return unless source.hostname == GITHUB_COM
-        return fetch_file_if_present(LOCKFILE_PATH) if directory == "/"
+        return unless source.hostname == GITHUB_COM || source.hostname.end_with?(".ghe.com")
+
+        fetch_file_if_present(relative_to_directory(LOCKFILE_PATH))
+      end
+
+      # Repository workflows a composite-action job needs to relock the lock. Support
+      # files only: the composite job must never bump the workflows' own refs.
+      sig { returns(T::Array[DependencyFile]) }
+      def repository_workflow_files
+        return [] if ["/", "/#{WORKFLOW_DIRECTORY}"].include?(File.join("/", directory))
+
+        @repository_workflow_files ||= T.let(
+          begin
+            dir = relative_to_directory(WORKFLOW_DIRECTORY)
+            repo_contents(dir: dir, raise_errors: false)
+              .select { |f| f.type == "file" && f.name.match?(MANIFEST_FILE_PATTERN) }
+              .map { |f| fetch_file_from_host(File.join(dir, f.name)) }
+              .each { |f| f.support_file = true }
+          end,
+          T.nilable(T::Array[DependencyFile])
+        )
+      end
+
+      sig { params(repo_path: String).returns(String) }
+      def relative_to_directory(repo_path)
+        Pathname.new(File.join("/", repo_path)).relative_path_from(File.join("/", directory)).to_s
+      end
+
+      # `$/` composites can live anywhere in the repo and can call each other, so
+      # relocking needs every action definition, at its repo-relative path.
+      sig { returns(T::Array[DependencyFile]) }
+      def self_repository_action_files
+        fetched = correctly_encoded_workflow_files + repository_workflow_files
+        return [] unless fetched.any? { |f| self_repository_uses?(f) }
+
+        # One recursive tree call. A truncated tree (>100k entries) may miss composites,
+        # which the engine then reports as an EngineError.
+        repo_action_paths
+          .reject { |path| fetched.any? { |f| f.path == path } }
+          .map do |path|
+            file = fetch_file_from_host(relative_to_directory(path))
+            file.support_file = true
+            file
+          end
+      end
+
+      sig { params(file: DependencyFile).returns(T::Boolean) }
+      def self_repository_uses?(file)
+        content = file.content.to_s
+        return false unless content.include?("$/")
+
+        WorkflowFile.new(content).uses_declarations.any? { |declaration| declaration.value.start_with?("$/") }
+      rescue Psych::SyntaxError, Psych::DisallowedClass, Psych::BadAlias
+        false
+      end
 
-        fetch_file_if_present(LOCKFILE_NAME) if directory.delete_prefix("/") == WORKFLOW_DIRECTORY
+      sig { returns(T::Array[String]) }
+      def repo_action_paths
+        tree = github_client.tree(repo, T.must(commit), recursive: true)
+        T.let(tree[:tree], T::Array[Sawyer::Resource])
+         .select { |entry| T.let(entry[:type], String) == "blob" }
+         .map { |entry| T.let("/#{entry[:path]}", String) }
+         .select { |path| ACTION_FILE_NAMES.include?(File.basename(path)) }
       end
 
       sig { returns(T::Array[DependencyFile]) }

data/lib/dependabot/github_actions/file_parser.rb

@@ -9,6 +9,7 @@ require "dependabot/errors"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
 require "dependabot/github_actions/constants"
+require "dependabot/github_actions/lockfile/reader"
 require "dependabot/github_actions/version"
 require "dependabot/github_actions/package_manager"
 require "dependabot/github_actions/workflow_file"
@@ -137,6 +138,9 @@ module Dependabot
         ).returns(Dependabot::Dependency)
       end
       def build_github_dependency(file, string, metadata)
+        locked = locked_hostname(string)
+        return github_dependency(file, string, locked, metadata) if locked
+
         unless source&.hostname == GITHUB_COM
           dep = github_dependency(file, string, T.must(source).hostname, metadata)
           git_checker = Dependabot::GitCommitChecker.new(dependency: dep, credentials: credentials)
@@ -193,9 +197,36 @@ module Dependabot
         )
       end
 
+      # A lockfile pin already names its host, so trust it over probing the tenant:
+      # a tenant blip must not silently rebind an in-tenant action to github.com.
+      sig { params(string: String).returns(T.nilable(String)) }
+      def locked_hostname(string)
+        reader = lockfile_reader
+        return unless reader
+
+        details = T.must(string.match(GITHUB_REPO_REFERENCE)).named_captures
+        action_ref = "#{details.fetch(OWNER_KEY)}/#{details.fetch(REPO_KEY)}@#{details.fetch(REF_KEY)}"
+        reader.pinned_hostname(action_ref, home: source&.hostname || GITHUB_COM)
+      end
+
+      # A malformed lock must not block parsing; the updater gates it at relock.
+      sig { returns(T.nilable(Lockfile::Reader)) }
+      def lockfile_reader
+        return @lockfile_reader if defined?(@lockfile_reader)
+
+        @lockfile_reader = T.let(
+          begin
+            Lockfile::Reader.from_files(dependency_files)
+          rescue Dependabot::DependencyFileNotParseable
+            nil
+          end,
+          T.nilable(Lockfile::Reader)
+        )
+      end
+
       sig { returns(T::Array[Dependabot::DependencyFile]) }
       def workflow_files
-        dependency_files.reject { |file| file.path.delete_prefix("/") == LOCKFILE_PATH }
+        dependency_files.reject { |file| file.support_file? || file.path.delete_prefix("/") == LOCKFILE_PATH }
       end
 
       sig { override.void }

data/lib/dependabot/github_actions/file_updater/workflow_updater.rb

@@ -176,11 +176,13 @@ module Dependabot
         def uses_declaration_pattern(declaration)
           escaped_declaration = Regexp.escape(declaration)
 
+          # The declaration must end at whitespace, a flow delimiter or the end of the line. `$` does not match
+          # before a carriage return, so a CRLF line ending has to be listed explicitly.
           /
             (?:^|[ \t{,])
             (?:"uses"|'uses'|uses)[ \t]*:[ \t]*
             (?:"#{escaped_declaration}"|'#{escaped_declaration}'|#{escaped_declaration})
-            (?=[ \t]|$|[,}\]])
+            (?=[ \t\r]|$|[,}\]])
           /x
         end
 

data/lib/dependabot/github_actions/file_updater.rb

@@ -1,6 +1,7 @@
 # typed: strong
 # frozen_string_literal: true
 
+require "pathname"
 require "sorbet-runtime"
 
 require "dependabot/errors"
@@ -63,16 +64,18 @@ module Dependabot
           .returns(T::Array[Dependabot::DependencyFile])
       end
       def relocked_files(updated_workflow_files)
-        changed_repository_workflows = changed_workflow_files.select do |file|
+        changed_repository_workflows, changed_actions = changed_workflow_files.partition do |file|
           File.dirname(repo_relative_path(file)) == WORKFLOW_DIRECTORY
         end
-        return [] if changed_repository_workflows.empty?
+        # A bumped composite changes the lock entries of every workflow reaching it.
+        affected_workflows = changed_repository_workflows | workflows_reaching(changed_actions)
+        return [] if affected_workflows.empty?
 
         lock = lockfile
         reader = lockfile_reader
         return [] unless lock && reader
 
-        changed_onboarded = changed_repository_workflows.select { |f| reader.onboarded?(repo_relative_path(f)) }
+        changed_onboarded = affected_workflows.select { |f| reader.onboarded?(repo_relative_path(f)) }
         return [] if changed_onboarded.empty?
 
         # Gate only once the lock is authoritative for a workflow we're changing, so an
@@ -82,15 +85,76 @@ module Dependabot
 
         # Materialize the full onboarded closure so the lock remains intact, but fix
         # only changed workflows so unrelated refs are not touched.
-        content = Lockfile::CliEngine.new(credentials).relock(
+        content = Lockfile::CliEngine.new(credentials, hostname: source_hostname).relock(
           workflow_files: rewritten_onboarded_workflow_files(reader, updated_workflow_files),
           lockfile: lock,
+          action_files: rewritten_action_files(updated_workflow_files),
           workflow_paths: changed_onboarded.map { |file| repo_relative_path(file) }
         )
 
         [updated_file(file: lock, content: content)]
       end
 
+      # Every action definition, with a bumped composite's rewritten content.
+      sig do
+        params(updated_workflow_files: T::Array[Dependabot::DependencyFile])
+          .returns(T::Array[Dependabot::DependencyFile])
+      end
+      def rewritten_action_files(updated_workflow_files)
+        updated_by_path = updated_workflow_files.to_h { |file| [repo_relative_path(file), file] }
+        dependency_files
+          .select { |file| ACTION_FILE_NAMES.include?(File.basename(file.name)) }
+          .map { |file| updated_by_path.fetch(repo_relative_path(file), file) }
+      end
+
+      # Repository workflows whose step-level `$/` chain (through nested composites)
+      # reaches a changed action. Only `$/` matters: gh-actions-lock never follows
+      # `./` actions.
+      sig do
+        params(changed_actions: T::Array[Dependabot::DependencyFile])
+          .returns(T::Array[Dependabot::DependencyFile])
+      end
+      def workflows_reaching(changed_actions)
+        return [] if changed_actions.empty?
+
+        targets = changed_actions.map { |file| repo_relative_path(file) }
+        dependency_files.select do |file|
+          File.dirname(repo_relative_path(file)) == WORKFLOW_DIRECTORY && !lockfile?(file) &&
+            reaches?(file, targets, Set.new)
+        end
+      end
+
+      sig do
+        params(file: Dependabot::DependencyFile, targets: T::Array[String], seen: T::Set[String])
+          .returns(T::Boolean)
+      end
+      def reaches?(file, targets, seen)
+        self_repository_files(file).any? do |target|
+          path = repo_relative_path(target)
+          seen.add?(path) && (targets.include?(path) || reaches?(target, targets, seen))
+        end
+      end
+
+      # Action definitions a workflow or composite references via step-level `$/`.
+      # Job-level `$/` reusable workflows own their lock entries, so they are not followed.
+      sig { params(file: Dependabot::DependencyFile).returns(T::Array[Dependabot::DependencyFile]) }
+      def self_repository_files(file)
+        content = file.content.to_s
+        return [] unless content.include?("$/")
+
+        WorkflowFile.new(content).uses_declarations.filter_map do |declaration|
+          next unless declaration.steps_sequence && declaration.value.start_with?("$/")
+
+          target = Pathname.new("./#{declaration.value.delete_prefix('$/')}").cleanpath.to_s
+          dependency_files.find do |candidate|
+            path = repo_relative_path(candidate)
+            File.dirname(path) == target && ACTION_FILE_NAMES.include?(File.basename(path))
+          end
+        end
+      rescue Psych::SyntaxError, Psych::DisallowedClass, Psych::BadAlias
+        []
+      end
+
       # The onboarded closure as the engine should see it: every workflow the lock
       # tracks, with bumped refs applied to changed ones and the rest left verbatim.
       sig do
@@ -114,6 +178,12 @@ module Dependabot
           .select { |f| reader.onboarded?(repo_relative_path(f)) }
       end
 
+      # The repository's home host, plumbed from the job source by the updater.
+      sig { returns(String) }
+      def source_hostname
+        T.cast(options.fetch(:source_hostname, GITHUB_COM), String)
+      end
+
       sig { returns(T.nilable(Dependabot::DependencyFile)) }
       def lockfile
         dependency_files.find { |f| lockfile?(f) }

data/lib/dependabot/github_actions/lockfile/cli_engine.rb

@@ -25,11 +25,27 @@ module Dependabot
 
         JsonObject = T.type_alias { T::Hash[String, Object] }
         FIXED_FINDING_CATEGORIES = %w(onboarding-required ref-changed stale).freeze
-        UNRESOLVABLE_CATEGORIES = %w(impostor-commit lockfile-forgery).freeze
-
-        sig { params(credentials: T::Array[Dependabot::Credential]).void }
-        def initialize(credentials)
+        UNRESOLVABLE_CATEGORIES = %w(
+          unreachable-pin repo-replaced repo-unavailable repo-renamed not-pinned
+          local-action invalid-self-repository-ref misleading-sha
+          tag-commit-mismatch incomplete-lockfile ref-missing invalid-workflow
+        ).freeze
+
+        # Host-identity failures from the engine: the lock is bound to a host it can't
+        # be verified on. User-actionable (restore/regenerate), never retryable. The
+        # engine wraps every lookup error, so only a 404 counts; 5xx/429/403/timeouts stay EngineError.
+        HOST_IDENTITY_ERROR = /verifying repository identity .*: HTTP 404\b|repository IDs|not the selected host/
+
+        # Write-time refusals (an incomplete lock graph, or a `uses:` cycle the lock
+        # can't record). Deterministic and user-actionable, so retrying never helps.
+        WRITE_REFUSED_ERROR = /refusing to write /
+
+        # `hostname` is the repository's home host. The engine binds every pin with an
+        # omitted lockfile `hostname` to it, so it must never be guessed.
+        sig { params(credentials: T::Array[Dependabot::Credential], hostname: String).void }
+        def initialize(credentials, hostname: GITHUB_COM)
           @credentials = credentials
+          @hostname = hostname
         end
 
         # Binary baked into the ecosystem image; falls back to PATH for local dev.
@@ -41,24 +57,35 @@ module Dependabot
 
         # Re-pins workflows already tracked in the lockfile. `--no-onboard` refuses new
         # workflows/actions (surfaced as onboarding-required skips); `--no-narrow`
-        # keeps the exact ref Dependabot wrote.
+        # keeps the exact ref Dependabot wrote. `--ignore-local-actions` keeps `./`
+        # actions a warning: the lock can't record them, Dependabot never rewrites
+        # them, and whether their action.yml is readable here depends on whether the
+        # repo also uses `$/`.
         sig do
           params(
             workflow_files: T::Array[Dependabot::DependencyFile],
             lockfile: Dependabot::DependencyFile,
-            workflow_paths: T::Array[String]
+            workflow_paths: T::Array[String],
+            action_files: T::Array[Dependabot::DependencyFile]
           ).returns(String)
         end
-        def relock(workflow_files:, lockfile:, workflow_paths: workflow_files.map { |file| repo_path(file) })
-          in_repo(workflow_files, lockfile) do |dir|
-            args = %w(--no-onboard --no-narrow --no-interactive --json=findings) + workflow_paths
+        def relock(
+          workflow_files:,
+          lockfile:,
+          workflow_paths: workflow_files.map { |file| repo_path(file) },
+          action_files: []
+        )
+          in_repo(workflow_files + action_files, lockfile) do |dir|
+            args = %w(--no-onboard --no-narrow --ignore-local-actions --no-interactive --json=findings) +
+                   ["--hostname", hostname] + workflow_paths
             json, exit_status = run(dir, args)
 
             skipped = onboarding_skips(json, lockfile)
             log_skips(skipped)
 
-            # `findings` is the PRE-fix diagnosis; at exit 0 fix-mode already resolved
-            # them. Only exit 1 can carry a survivor (impostor/forgery or a skip).
+            # At exit 1 `findings` is the pre-fix diagnosis of what blocked the fix;
+            # at exit 0 it reports the post-fix state. Writes are all-or-nothing, so
+            # exit 1 means nothing was written.
             raise_on_findings(json) if exit_status == 1
 
             File.read(File.join(dir, LOCKFILE_PATH))
@@ -70,6 +97,9 @@ module Dependabot
         sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
 
+        sig { returns(String) }
+        attr_reader :hostname
+
         sig do
           type_parameters(:T)
             .params(
@@ -99,11 +129,16 @@ module Dependabot
 
         # Invokes the binary and returns [parsed JSON, exit code]. Exit is tri-state:
         # 0 = valid, 1 = blocking findings (still well-formed JSON on stdout, parse it),
-        # 2+ = tool failure (no usable JSON). JSON and exit are not interchangeable in
-        # fix-mode: findings/valid are PRE-fix, exit is POST-fix, so callers gate on exit.
+        # 2+ = tool failure (no usable JSON). In fix-mode, findings/valid describe the
+        # post-fix state after a successful fix but the pre-fix state at exit 1, so
+        # callers gate on exit.
         sig { params(dir: String, args: T::Array[String]).returns([JsonObject, Integer]) }
         def run(dir, args)
           stdout, stderr, exit_status = invoke(dir, args)
+          if exit_status > 1 && stderr.match?(Regexp.union(HOST_IDENTITY_ERROR, WRITE_REFUSED_ERROR))
+            raise DependencyFileNotResolvable, stderr.strip
+          end
+
           raise EngineError, "gh-actions-lock failed (exit #{exit_status}): #{stderr.strip}" if exit_status > 1
 
           json = case (parsed = JSON.parse(stdout))
@@ -120,7 +155,9 @@ module Dependabot
         # [stdout, stderr, exit_status].
         sig { params(dir: String, args: T::Array[String]).returns([String, String, Integer]) }
         def invoke(dir, args)
-          env_cmd = [Env.build(credentials), self.class.binary_path, *args, { chdir: dir }]
+          # The temp dir has no .git, so name the root that `$/` paths resolve against.
+          env = Env.build(credentials, hostname).merge("GH_ACTIONS_LOCK_REPO_ROOT" => dir)
+          env_cmd = [env, self.class.binary_path, *args, { chdir: dir }]
           stdout, stderr, process = CommandHelpers.capture3_with_timeout(env_cmd)
 
           # A failed spawn comes back as a nil status, not an exception.
@@ -133,23 +170,21 @@ module Dependabot
           [stdout || "", stderr || "", process.exitstatus]
         end
 
+        # Exit 1 wrote nothing. Any user-actionable finding wins; anything else retries.
         sig { params(json: JsonObject).void }
         def raise_on_findings(json)
-          T.cast(Array(json["findings"]), T::Array[JsonObject]).each do |finding|
-            next unless finding["severity"].nil? || finding["severity"] == "error"
-
-            category = finding["category"].to_s
-            next if FIXED_FINDING_CATEGORIES.include?(category)
-
-            if UNRESOLVABLE_CATEGORIES.include?(category)
-              raise UnresolvableDependency.new(
-                (finding["dependency"] || "unknown").to_s,
-                (finding["detail"] || category).to_s
-              )
-            end
-
-            raise EngineError, "gh-actions-lock left an unhandled #{category.inspect} finding"
+          errors = T.cast(Array(json["findings"]), T::Array[JsonObject])
+                    .select { |finding| finding["severity"].nil? || finding["severity"] == "error" }
+          unresolvable = errors.find { |finding| UNRESOLVABLE_CATEGORIES.include?(finding["category"].to_s) }
+          if unresolvable
+            raise UnresolvableDependency.new(
+              (unresolvable["dependency"] || unresolvable["workflow"] || "unknown").to_s,
+              (unresolvable["detail"] || unresolvable["category"]).to_s
+            )
           end
+
+          categories = errors.map { |finding| finding["category"].to_s }.uniq - FIXED_FINDING_CATEGORIES
+          raise EngineError, "gh-actions-lock exited 1 without an actionable finding: #{categories.inspect}"
         end
 
         # Partitions onboarding-required findings into genuine skips vs. a lock the

data/lib/dependabot/github_actions/lockfile/env.rb

@@ -11,7 +11,9 @@ module Dependabot
     module Lockfile
       # Builds the subprocess environment for the gh-actions-lock engine. Hosted
       # Dependabot is tokenless behind a MITM proxy that overwrites the auth header,
-      # while proxyless local runs hold the real github.com token in `credentials`.
+      # while proxyless local runs hold the real home-host token in `credentials`.
+      # Only a home-host `git_source` token is ever used; the engine reads other
+      # hosts (dotcom fallback) anonymously.
       module Env
         extend T::Sig
 
@@ -20,13 +22,13 @@ module Dependabot
         DUMMY_TOKEN = "x-access-token"
 
         sig do
-          params(credentials: T::Array[Dependabot::Credential])
+          params(credentials: T::Array[Dependabot::Credential], hostname: String)
             .returns(T::Hash[String, String])
         end
-        def self.build(credentials)
+        def self.build(credentials, hostname = GITHUB_COM)
           env = {}
 
-          github_credential = github_dot_com_credential(credentials)
+          github_credential = home_credential(credentials, hostname)
           env["GH_TOKEN"] = github_credential&.fetch("password", nil) || DUMMY_TOKEN
           env["GH_ACTIONS_LOCK_DEPENDABOT_PROXY"] = "1" unless github_credential
 
@@ -36,12 +38,12 @@ module Dependabot
         # Mirrors SharedHelpers.configure_git_to_use_https_with_credentials: prefer a
         # deliberately-added token over an app installation token ("v1." prefix).
         sig do
-          params(credentials: T::Array[Dependabot::Credential])
+          params(credentials: T::Array[Dependabot::Credential], hostname: String)
             .returns(T.nilable(Dependabot::Credential))
         end
-        def self.github_dot_com_credential(credentials)
+        def self.home_credential(credentials, hostname)
           candidates = credentials.select do |c|
-            c["type"] == "git_source" && c["host"] == GITHUB_COM && c["password"]
+            c["type"] == "git_source" && c["host"] == hostname && c["password"]
           end
 
           candidates.find { |c| !c["password"]&.start_with?("v1.") } || candidates.first

data/lib/dependabot/github_actions/lockfile/errors.rb

@@ -23,7 +23,7 @@ module Dependabot
           super(
             LOCKFILE_PATH,
             "Unsupported actions.lock version #{found.inspect}; " \
-            "this version of Dependabot supports #{supported.inspect}. " \
+            "this version of Dependabot supports #{supported}. " \
             "Upgrade Dependabot or regenerate the lockfile with a compatible gh-actions-lock version."
           )
         end

data/lib/dependabot/github_actions/lockfile/reader.rb

@@ -67,6 +67,23 @@ module Dependabot
           Array(workflows[path]).include?(action_ref)
         end
 
+        # The host a pinned `owner/repo@ref` is bound to. An omitted `hostname` means
+        # `home` in v0.0.3 and github.com in older schemas. Nil when unpinned or when
+        # bound to a host other than `home` or github.com.
+        sig { params(action_ref: String, home: String).returns(T.nilable(String)) }
+        def pinned_hostname(action_ref, home:)
+          nwo, _, ref = action_ref.rpartition("@")
+          entry = dependencies.find do |key, _|
+            key_nwo, _, key_ref = key.to_s.rpartition("@")
+            key_ref == ref && key_nwo.casecmp?(nwo)
+          end&.last
+          return unless entry.is_a?(Hash)
+
+          hostname = entry["hostname"].to_s
+          hostname = version == "v0.0.3" ? home : GITHUB_COM if hostname.empty?
+          hostname if [home, GITHUB_COM].include?(hostname)
+        end
+
         # Asserts every `dependencies` entry carries {REQUIRED_DEPENDENCY_KEYS}. A
         # missing key makes the engine silently treat the whole lockfile as empty.
         # Deferred to the relock gate (not the constructor) so a malformed lock

data/lib/dependabot/github_actions/lockfile/version_gate.rb

@@ -10,7 +10,7 @@ module Dependabot
   module GithubActions
     module Lockfile
       # Pre-1.0 lockfile schema revisions may be breaking, so only the explicitly
-      # supported version is safe to read and rewrite.
+      # supported versions are safe to read and rewrite.
       module VersionGate
         extend T::Sig
 
@@ -18,12 +18,12 @@ module Dependabot
         def self.assert_supported!(found)
           return if compatible?(found)
 
-          raise UnsupportedLockfileVersion.new(found, SUPPORTED_LOCKFILE_VERSION)
+          raise UnsupportedLockfileVersion.new(found, SUPPORTED_LOCKFILE_VERSIONS.join(", "))
         end
 
         sig { params(found: String).returns(T::Boolean) }
         def self.compatible?(found)
-          found == SUPPORTED_LOCKFILE_VERSION
+          SUPPORTED_LOCKFILE_VERSIONS.include?(found)
         end
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-github_actions
 version: !ruby/object:Gem::Version
-  version: 0.400.0
+  version: 0.402.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.402.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.402.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -278,7 +278,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.402.0
 rdoc_options: []
 require_paths:
 - lib