Skip to content

fix: prune orphaned entries from actions-lock.json on full compile #39905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 12 commits into from
Jun 18, 2026
Merged

fix: prune orphaned entries from actions-lock.json on full compile #39905

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
c8c128e
Initial plan
Copilot Jun 17, 2026
c73a3d1
initial plan (no code changes yet)
Copilot Jun 17, 2026
5d7a94f
fix: prune orphaned entries from actions-lock.json during compile
Copilot Jun 17, 2026
da93d81
Apply remaining changes
Copilot Jun 17, 2026
9d3dbee
Merge branch 'main' into copilot/fix-orphaned-entries-actions-lock
pelikhan Jun 17, 2026
5667e11
chore: start PR feedback triage
Copilot Jun 17, 2026
a20d8a6
Merge branch 'main' into copilot/fix-orphaned-entries-actions-lock
github-actions[bot] Jun 17, 2026
4144995
fix: harden orphaned cache pruning safeguards
Copilot Jun 17, 2026
759b479
fix: preserve compiler-generated actions during orphaned entry pruning
Copilot Jun 18, 2026
ae5c619
fix: preserve runtime-managed actions during orphaned entry pruning
Copilot Jun 18, 2026
319a2af
test: enhance container pin sorting test with explicit order verifica…
Copilot Jun 18, 2026
81d30ca
Merge branch 'main' into copilot/fix-orphaned-entries-actions-lock
pelikhan Jun 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
103 changes: 39 additions & 64 deletions .github/aw/actions-lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,16 +23,6 @@
},
"action_description": "Add labels to an issue or a pull request."
},
"actions/ai-inference@v2.1.1": {
"repo": "actions/ai-inference",
"version": "v2.1.1",
"sha": "a7805884c80886efc241e94a5351df715968a0ad"
},
"actions/attest-build-provenance@v4.1.0": {
"repo": "actions/attest-build-provenance",
"version": "v4.1.0",
"sha": "a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32"
},
"actions/cache/restore@v5.0.5": {
"repo": "actions/cache/restore",
"version": "v5.0.5",
Expand Down Expand Up @@ -68,21 +58,11 @@
"version": "v9.0.0",
"sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
},
"actions/setup-dotnet@v5.3.0": {
"repo": "actions/setup-dotnet",
"version": "v5.3.0",
"sha": "9a946fdbd5fb07b82b2f5a4466058b876ab72bb2"
},
"actions/setup-go@v6.4.0": {
"repo": "actions/setup-go",
"version": "v6.4.0",
"sha": "4a3601121dd01d1626a1e23e37211e3254c1c06c"
},
"actions/setup-java@v5.2.0": {
"repo": "actions/setup-java",
"version": "v5.2.0",
"sha": "be666c2fcd27ec809703dec50e508c2fdc7f6654"
},
"actions/setup-node@v6.4.0": {
"repo": "actions/setup-node",
"version": "v6.4.0",
Expand All @@ -103,21 +83,6 @@
"version": "v0.24.0",
"sha": "e22c389904149dbc22b58101806040fa8d37a610"
},
"astral-sh/setup-uv@v8.2.0": {
"repo": "astral-sh/setup-uv",
"version": "v8.2.0",
"sha": "fac544c07dec837d0ccb6301d7b5580bf5edae39"
},
"cli/gh-extension-precompile@v2.1.0": {
"repo": "cli/gh-extension-precompile",
"version": "v2.1.0",
"sha": "9e2237c30f869ad3bcaed6a4be2cd43564dd421b"
},
"denoland/setup-deno@v2.0.4": {
"repo": "denoland/setup-deno",
"version": "v2.0.4",
"sha": "667a34cdef165d8d2b2e98dde39547c9daac7282"
},
"docker/build-push-action@v7.2.0": {
"repo": "docker/build-push-action",
"version": "v7.2.0",
Expand All @@ -140,41 +105,61 @@
"version": "v4.1.0",
"sha": "d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5"
},
"erlef/setup-beam@v1.24.0": {
"repo": "erlef/setup-beam",
"version": "v1.24.0",
"sha": "fc68ffb90438ef2936bbb3251622353b3dcb2f93"
},
"github/codeql-action/upload-sarif@v4.36.2": {
"repo": "github/codeql-action/upload-sarif",
"version": "v4.36.2",
"sha": "8aad20d150bbac5944a9f9d289da16a4b0d87c1e"
},
"github/gh-aw-actions/setup@v0.79.8": {
"repo": "github/gh-aw-actions/setup",
"version": "v0.79.8",
"sha": "c0338fef4749d08c21f8f975fb0e37efa17dda47"
"github/stale-repos@v9.0.14": {
"repo": "github/stale-repos",
"version": "v9.0.14",
"sha": "378f317724a25737b846bd9895bacf5726dd72ff"
},
"safedep/pmg@v1": {
"repo": "safedep/pmg",
"version": "v1",
"sha": "46cc70db535107183c9e752bb55d1d5c5f1a9290"
},
"super-linter/super-linter@v8.6.0": {
"repo": "super-linter/super-linter",
"version": "v8.6.0",
"sha": "9e863354e3ff62e0727d37183162c4a88873df41"
},
"actions/setup-dotnet@v5.3.0": {
"repo": "actions/setup-dotnet",
"version": "v5.3.0",
"sha": "9a946fdbd5fb07b82b2f5a4466058b876ab72bb2"
},
"actions/setup-java@v5.2.0": {
"repo": "actions/setup-java",
"version": "v5.2.0",
"sha": "be666c2fcd27ec809703dec50e508c2fdc7f6654"
},
"astral-sh/setup-uv@v8.2.0": {
"repo": "astral-sh/setup-uv",
"version": "v8.2.0",
"sha": "fac544c07dec837d0ccb6301d7b5580bf5edae39"
},
"denoland/setup-deno@v2.0.4": {
"repo": "denoland/setup-deno",
"version": "v2.0.4",
"sha": "667a34cdef165d8d2b2e98dde39547c9daac7282"
},
"erlef/setup-beam@v1.24.0": {
"repo": "erlef/setup-beam",
"version": "v1.24.0",
"sha": "fc68ffb90438ef2936bbb3251622353b3dcb2f93"
},
"github/gh-aw/actions/setup-cli@v0.79.8": {
"repo": "github/gh-aw/actions/setup-cli",
"version": "v0.79.8",
"sha": "8b02ab336d100a5746e9f53b8bc2b22878278a6f"
},
"github/stale-repos@v9.0.14": {
"repo": "github/stale-repos",
"version": "v9.0.14",
"sha": "378f317724a25737b846bd9895bacf5726dd72ff"
},
"haskell-actions/setup@v2.11.0": {
"repo": "haskell-actions/setup",
"version": "v2.11.0",
"sha": "cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553"
},
"microsoft/apm-action@v1.9.1": {
"repo": "microsoft/apm-action",
"version": "v1.9.1",
"sha": "e5650fb81c4b5965090a17bd1ed1956071e95d17"
},
"oven-sh/setup-bun@v2.2.0": {
"repo": "oven-sh/setup-bun",
"version": "v2.2.0",
Expand All @@ -184,16 +169,6 @@
"repo": "ruby/setup-ruby",
"version": "v1.313.0",
"sha": "89f90524b88a01fe6e0b732220432cc6142926af"
},
"safedep/pmg@v1": {
"repo": "safedep/pmg",
"version": "v1",
"sha": "46cc70db535107183c9e752bb55d1d5c5f1a9290"
},
"super-linter/super-linter@v8.6.0": {
"repo": "super-linter/super-linter",
"version": "v8.6.0",
"sha": "9e863354e3ff62e0727d37183162c4a88873df41"
}
},
"containers": {
Expand Down
2 changes: 1 addition & 1 deletion actions/setup-cli/install.sh
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

103 changes: 39 additions & 64 deletions pkg/actionpins/data/action_pins.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,16 +23,6 @@
},
"action_description": "Add labels to an issue or a pull request."
},
"actions/ai-inference@v2.1.1": {
"repo": "actions/ai-inference",
"version": "v2.1.1",
"sha": "a7805884c80886efc241e94a5351df715968a0ad"
},
"actions/attest-build-provenance@v4.1.0": {
"repo": "actions/attest-build-provenance",
"version": "v4.1.0",
"sha": "a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32"
},
"actions/cache/restore@v5.0.5": {
"repo": "actions/cache/restore",
"version": "v5.0.5",
Expand Down Expand Up @@ -68,21 +58,11 @@
"version": "v9.0.0",
"sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
},
"actions/setup-dotnet@v5.3.0": {
"repo": "actions/setup-dotnet",
"version": "v5.3.0",
"sha": "9a946fdbd5fb07b82b2f5a4466058b876ab72bb2"
},
"actions/setup-go@v6.4.0": {
"repo": "actions/setup-go",
"version": "v6.4.0",
"sha": "4a3601121dd01d1626a1e23e37211e3254c1c06c"
},
"actions/setup-java@v5.2.0": {
"repo": "actions/setup-java",
"version": "v5.2.0",
"sha": "be666c2fcd27ec809703dec50e508c2fdc7f6654"
},
"actions/setup-node@v6.4.0": {
"repo": "actions/setup-node",
"version": "v6.4.0",
Expand All @@ -103,21 +83,6 @@
"version": "v0.24.0",
"sha": "e22c389904149dbc22b58101806040fa8d37a610"
},
"astral-sh/setup-uv@v8.2.0": {
"repo": "astral-sh/setup-uv",
"version": "v8.2.0",
"sha": "fac544c07dec837d0ccb6301d7b5580bf5edae39"
},
"cli/gh-extension-precompile@v2.1.0": {
"repo": "cli/gh-extension-precompile",
"version": "v2.1.0",
"sha": "9e2237c30f869ad3bcaed6a4be2cd43564dd421b"
},
"denoland/setup-deno@v2.0.4": {
"repo": "denoland/setup-deno",
"version": "v2.0.4",
"sha": "667a34cdef165d8d2b2e98dde39547c9daac7282"
},
"docker/build-push-action@v7.2.0": {
"repo": "docker/build-push-action",
"version": "v7.2.0",
Expand All @@ -140,41 +105,61 @@
"version": "v4.1.0",
"sha": "d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5"
},
"erlef/setup-beam@v1.24.0": {
"repo": "erlef/setup-beam",
"version": "v1.24.0",
"sha": "fc68ffb90438ef2936bbb3251622353b3dcb2f93"
},
"github/codeql-action/upload-sarif@v4.36.2": {
"repo": "github/codeql-action/upload-sarif",
"version": "v4.36.2",
"sha": "8aad20d150bbac5944a9f9d289da16a4b0d87c1e"
},
"github/gh-aw-actions/setup@v0.79.8": {
"repo": "github/gh-aw-actions/setup",
"version": "v0.79.8",
"sha": "c0338fef4749d08c21f8f975fb0e37efa17dda47"
"github/stale-repos@v9.0.14": {
"repo": "github/stale-repos",
"version": "v9.0.14",
"sha": "378f317724a25737b846bd9895bacf5726dd72ff"
},
"safedep/pmg@v1": {
"repo": "safedep/pmg",
"version": "v1",
"sha": "46cc70db535107183c9e752bb55d1d5c5f1a9290"
},
"super-linter/super-linter@v8.6.0": {
"repo": "super-linter/super-linter",
"version": "v8.6.0",
"sha": "9e863354e3ff62e0727d37183162c4a88873df41"
},
"actions/setup-dotnet@v5.3.0": {
"repo": "actions/setup-dotnet",
"version": "v5.3.0",
"sha": "9a946fdbd5fb07b82b2f5a4466058b876ab72bb2"
},
"actions/setup-java@v5.2.0": {
"repo": "actions/setup-java",
"version": "v5.2.0",
"sha": "be666c2fcd27ec809703dec50e508c2fdc7f6654"
},
"astral-sh/setup-uv@v8.2.0": {
"repo": "astral-sh/setup-uv",
"version": "v8.2.0",
"sha": "fac544c07dec837d0ccb6301d7b5580bf5edae39"
},
"denoland/setup-deno@v2.0.4": {
"repo": "denoland/setup-deno",
"version": "v2.0.4",
"sha": "667a34cdef165d8d2b2e98dde39547c9daac7282"
},
"erlef/setup-beam@v1.24.0": {
"repo": "erlef/setup-beam",
"version": "v1.24.0",
"sha": "fc68ffb90438ef2936bbb3251622353b3dcb2f93"
},
"github/gh-aw/actions/setup-cli@v0.79.8": {
"repo": "github/gh-aw/actions/setup-cli",
"version": "v0.79.8",
"sha": "8b02ab336d100a5746e9f53b8bc2b22878278a6f"
},
"github/stale-repos@v9.0.14": {
"repo": "github/stale-repos",
"version": "v9.0.14",
"sha": "378f317724a25737b846bd9895bacf5726dd72ff"
},
"haskell-actions/setup@v2.11.0": {
"repo": "haskell-actions/setup",
"version": "v2.11.0",
"sha": "cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553"
},
"microsoft/apm-action@v1.9.1": {
"repo": "microsoft/apm-action",
"version": "v1.9.1",
"sha": "e5650fb81c4b5965090a17bd1ed1956071e95d17"
},
"oven-sh/setup-bun@v2.2.0": {
"repo": "oven-sh/setup-bun",
"version": "v2.2.0",
Expand All @@ -184,16 +169,6 @@
"repo": "ruby/setup-ruby",
"version": "v1.313.0",
"sha": "89f90524b88a01fe6e0b732220432cc6142926af"
},
"safedep/pmg@v1": {
"repo": "safedep/pmg",
"version": "v1",
"sha": "46cc70db535107183c9e752bb55d1d5c5f1a9290"
},
"super-linter/super-linter@v8.6.0": {
"repo": "super-linter/super-linter",
"version": "v8.6.0",
"sha": "9e863354e3ff62e0727d37183162c4a88873df41"
}
},
"containers": {
Expand Down
8 changes: 7 additions & 1 deletion pkg/cli/compile_pipeline.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -433,7 +433,7 @@ func compileAllFilesInDirectory(
}

// Post-processing
if err := runPostProcessingForDirectory(ctx, compiler, workflowDataList, config, workflowsDir, gitRoot, successCount); err != nil {
if err := runPostProcessingForDirectory(ctx, compiler, workflowDataList, config, workflowsDir, gitRoot, successCount, errorCount); err != nil {
return workflowDataList, err
}

Expand Down Expand Up @@ -551,6 +551,7 @@ func runPostProcessingForDirectory(
workflowsDir string,
gitRoot string,
successCount int,
errorCount int,
) error {
// Get action cache
actionCache := compiler.GetSharedActionCache()
Expand Down Expand Up @@ -598,6 +599,11 @@ func runPostProcessingForDirectory(
// Prune stale gh-aw-actions entries before saving
pruneStaleActionCacheEntries(compiler, actionCache)

// Prune orphaned entries — entries for action versions no longer referenced
// by any workflow in the directory (e.g. old pins left after a version bump).
// Safe to call only after a full-directory compilation with zero compile errors.
pruneOrphanedActionCacheEntries(compiler, actionCache, errorCount)

// Save action cache (errors are logged but non-fatal)
_ = saveActionCache(actionCache, config.Verbose)

Expand Down
28 changes: 28 additions & 0 deletions pkg/cli/compile_post_processing.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,3 +298,31 @@ func pruneStaleActionCacheEntries(compiler *workflow.Compiler, actionCache *work

actionCache.PruneStaleGHAWEntries(version, compiler.EffectiveActionsRepo())
}

// pruneOrphanedActionCacheEntries removes entries from the action cache that were
// not referenced during the current compilation run. This garbage-collects entries
// for action versions no longer used by any workflow in the target directory (e.g.
// old version pins left behind after bumping a `uses:` tag).
//
// This is only safe to call after a full-directory compilation — compiling a
// subset of files would incorrectly prune entries still referenced by other
// (uncompiled) workflows — and only when there were zero compile errors.
func pruneOrphanedActionCacheEntries(compiler *workflow.Compiler, actionCache *workflow.ActionCache, errorCount int) {
if actionCache == nil {
return
}
if errorCount > 0 {
return
}

resolver := compiler.GetSharedActionResolver()
if resolver == nil {
return
}

usedKeys := resolver.GetUsedCacheKeys()
pruned := actionCache.PruneOrphanedEntries(usedKeys)
if pruned > 0 {
compilePostProcessingLog.Printf("Pruned %d orphaned entries from actions-lock.json", pruned)
}
}
Loading
Loading