[interimadd]

PR Type

• Improvement

Related Links

• ci: comply with the organization's GitHub Actions security policy #518
• ci: workaround -- pin actions nested inside composite actions and reusable workflows #519
• GitHub Actions workflow lockfiles are generally available
• Workflow dependency lockfiles
• ci: use workflow dependency lockfile instead of SHA pinning driving_log_replayer_v2#429 (the same change in another repository)

Description

This PR is a proposal for discussion. It replaces the workaround in #519 with a workflow dependency lockfile (.github/workflows/actions.lock).

The lockfile records the commit of each action, including the actions that composite actions call. GitHub Actions runs the recorded commits. Thus the organization policy for full-length commit SHAs is satisfied without vendored copies of upstream actions. Workflow lockfiles became generally available on 2026-10-28.

In tier4/driving_log_replayer_v2#429, the same approach passed the policy check for actions nested in composite actions (actions/cache@v4 in pre-commit/action, cspell-action@v9 in spell-check).

This PR has two commits:

1. Revert ci: workaround -- pin actions nested inside composite actions and reusable workflows #519. This removes the vendored .github/actions/colcon-build and .github/actions/colcon-test, and uses the upstream actions again.
2. Generate the lockfile with gh actions-lock v0.4.0. The tool changes the uses: references from SHAs to exact tags (for example actions/checkout@v7.0.1).

The other changes from #518 (permissions, concurrency, and inputs passed through env) are not changed.

Exception: semantic-pull-request

gh actions-lock does not lock reusable workflows from other repositories (limitation, github/gh-actions-lock#179). Thus this PR keeps the inlined job from #519 in semantic-pull-request.yaml.

Behavior compared to #519

• pre-commit-optional uses the upstream autoware-github-actions/pre-commit again. Its autofix push step cannot push with contents: read. If pre-commit finds no changes, the step does nothing. If pre-commit changes files, the job fails, but it fails in that case already.
• documentation.yml uses actions/upload-pages-artifact@v3.0.1 again. The lockfile locks its nested actions/upload-artifact@v4.

Review Procedure

1. Make sure that the CI jobs pass the setup step and are not rejected by the SHA pinning policy.
2. Run gh actions-lock --verify locally. The result must be All 9 workflows valid. It shows a warning for the ros:${{ matrix.rosdistro }} container image, because the lockfile cannot lock container images.

Remarks

To update the lockfile, install the extension and run it:

gh extension install github/gh-actions-lock
gh actions-lock

Dependabot updates the lockfile entry in the same pull request when it updates an action.

Pre-Review Checklist for the PR Author

PR Author should check the checkboxes below when creating the PR.

• Assign PR to reviewer

Checklist for the PR Reviewer

Reviewers should check the checkboxes below before approval.

• Commits are properly organized and messages are according to the guideline
• (Optional) Unit tests have been written for new behavior
• PR title describes the changes

Post-Review Checklist for the PR Author

PR Author should check the checkboxes below before merging.

• All open points are addressed and tracked via issues or tickets

CI Checks

• Build and test for PR: Required to pass before the merge.

[mojomex]

Reviewed code changes, CI status and gh actions-lock --verify. LGTM!

[mojomex]

@interimadd Thank you so much, I was looking for a nice solution like this. I'm 100% for it.