chore(ci): pin actions through cdkactions 2.2.0 and sync Dependabot bumps

.github/cdk/main.ts

@@ -1,6 +1,22 @@
 // The workflows in .github/workflows are generated from here. Run
 // `yarn build` in this directory and commit both sides.
-import { App, Job, RunnerLabel, Stack, Workflow } from '@factbird/cdkactions';
+import {
+  App,
+  checkoutV7,
+  DependabotActionPinSync,
+  determinateNixV3,
+  Job,
+  RunnerLabel,
+  Stack,
+  setupNodeV6,
+  updateFlakeLockV29,
+  Workflow,
+} from '@factbird/cdkactions';
+
+const checkout = checkoutV7.pinned('3d3c42e5aac5ba805825da76410c181273ba90b1', 'v7.0.1');
+const determinateNix = determinateNixV3.pinned('d0c908e6cbe9f89f36ed8205a3ab6f092636916a', 'v3.23.1');
+const updateFlakeLock = updateFlakeLockV29.pinned('da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3', 'v29');
+const setupNode = setupNodeV6.pinned('249970729cb0ef3589644e2896645e5dc5ba9c38', 'v6.5.0');
 
 const app = new App({ createValidateWorkflow: false, outdir: '../workflows' });
 const stack = new Stack(app, 'devkit');
@@ -27,21 +43,30 @@ new Job(updateNixpkgs, 'update', {
   runsOn: RunnerLabel.UBUNTU_LATEST,
   permissions: { contents: 'write', pullRequests: 'write' },
   steps: [
-    { uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' }, // v7.0.1
-    {
-      name: 'Install Nix',
-      uses: 'DeterminateSystems/determinate-nix-action@d0c908e6cbe9f89f36ed8205a3ab6f092636916a', // v3.23.1
-    },
-    {
+    checkout({ id: 'checkout' }),
+    determinateNix({ name: 'Install Nix' }),
+    updateFlakeLock({
+      id: 'update-flake-lock',
       name: 'Update nixpkgs and open pull request',
-      uses: 'DeterminateSystems/update-flake-lock@da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3', // v29
       with: {
         inputs: 'nixpkgs',
         branch: 'chore/update-nixpkgs',
-        'commit-msg': 'chore(nix): update nixpkgs',
-        'pr-title': 'chore(nix): update nixpkgs',
+        commitMsg: 'chore(nix): update nixpkgs',
+        prTitle: 'chore(nix): update nixpkgs',
       },
-    },
+    }),
+  ],
+});
+
+// The CLI and the synth run from the repository root, while this package
+// keeps its own node_modules.
+new DependabotActionPinSync(stack, 'dependabot-action-pin-sync', {
+  sources: ['.github/cdk/main.ts'],
+  cliCommand: '.github/cdk/node_modules/.bin/cdkactions',
+  synthCommand: 'yarn --cwd .github/cdk build',
+  setupSteps: [
+    setupNode({ id: 'setup-node', with: { nodeVersion: '24' } }),
+    { name: 'Install', run: 'corepack enable && yarn --cwd .github/cdk install --immutable' },
   ],
 });
 

.github/cdk/package.json

@@ -8,8 +8,8 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@factbird/cdkactions": "2.1.2",
-    "@factbird/cdkactions-cli": "2.1.2",
+    "@factbird/cdkactions": "^2.2.0",
+    "@factbird/cdkactions-cli": "^2.2.0",
     "@types/node": "^24.0.0",
     "constructs": "10.4.2",
     "typescript": "^5.7.3"

.github/cdk/yarn.lock

@@ -5,30 +5,30 @@ __metadata:
   version: 9
   cacheKey: 10c0
 
-"@factbird/cdkactions-cli@npm:2.1.2":
-  version: 2.1.2
-  resolution: "@factbird/cdkactions-cli@npm:2.1.2"
+"@factbird/cdkactions-cli@npm:^2.2.0":
+  version: 2.2.0
+  resolution: "@factbird/cdkactions-cli@npm:2.2.0"
   dependencies:
-    "@factbird/cdkactions": "npm:2.1.2"
+    "@factbird/cdkactions": "npm:2.2.0"
     constructs: "npm:^10.4.2"
     fs-extra: "npm:^11.3.0"
     yaml: "npm:^2.7.1"
     yargs: "npm:^16.2.0"
   bin:
     cdkactions: bin/cdkactions
-  checksum: 10c0/7d92934edeee42ba771f852140189caba9e74c1ee91e4f6733529034d378acb460c8ddbf6dc10db827af615ee28894b65c14d0481db6c92e2c9dd960febce5bb
+  checksum: 10c0/cdeaacbf365ff83dfb262a26bd2fb538eb39f37e1cd5deb62ea97bd7d7ed2b2f78e094921213fcdccfb9c149e81f53f2f4f41ac7da72c2ce8a112c070f649807
   languageName: node
   linkType: hard
 
-"@factbird/cdkactions@npm:2.1.2":
-  version: 2.1.2
-  resolution: "@factbird/cdkactions@npm:2.1.2"
+"@factbird/cdkactions@npm:2.2.0, @factbird/cdkactions@npm:^2.2.0":
+  version: 2.2.0
+  resolution: "@factbird/cdkactions@npm:2.2.0"
   dependencies:
     js-yaml: "npm:^4.0.0"
     ts-dedent: "npm:^2.2.0"
   peerDependencies:
     constructs: ^10.4.2
-  checksum: 10c0/28e6666887eec322ea7dc012c3a87fdf282393589c5e58cf5d486732380ec9fd0ce31614ce788c90f582a1830a00968fef66f62fedb706315f4c11d4c9d76451
+  checksum: 10c0/275783658cc6281fa1a4672f25f0c2dcc46e48a1ab0fb4604666492fd32788559290ed915748857030022beeab02317a11429fad86fe1bcc249a459e83d3ec40
   languageName: node
   linkType: hard
 
@@ -109,8 +109,8 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "devkit-workflows@workspace:."
   dependencies:
-    "@factbird/cdkactions": "npm:2.1.2"
-    "@factbird/cdkactions-cli": "npm:2.1.2"
+    "@factbird/cdkactions": "npm:^2.2.0"
+    "@factbird/cdkactions-cli": "npm:^2.2.0"
     "@types/node": "npm:^24.0.0"
     constructs: "npm:10.4.2"
     typescript: "npm:^5.7.3"

.github/dependabot.yml

@@ -13,6 +13,16 @@ updates:
       flake-inputs:
         patterns:
           - '*'
+  - package-ecosystem: github-actions
+    directory: '/'
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - '*'
   - package-ecosystem: npm
     directory: '/.github/cdk'
     schedule:

.github/workflows/cdkactions_dependabot-action-pin-sync.yaml

@@ -0,0 +1,117 @@
+# Generated by cdkactions. Do not modify
+# Generated as part of the 'devkit' stack.
+name: Carry Dependabot action bumps into the workflow source
+on:
+  pull_request:
+    paths:
+      - .github/workflows/**
+    types:
+      - opened
+      - synchronize
+      - reopened
+permissions:
+  contents: read
+jobs:
+  push:
+    if: ((github.event.pull_request.user.login == 'dependabot[bot]' && github.actor == 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository) && needs.regenerate.outputs.changed == 'true')
+    needs: regenerate
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+      - id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510
+        with:
+          client-id: ${{ secrets.APP_ID }}
+          permission-contents: write
+          private-key: ${{ secrets.APP_PEM }}
+      - id: download
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
+        with:
+          artifact-ids: ${{ needs.regenerate.outputs.artifactId }}
+          path: ${{ runner.temp }}/action-pin-sync
+      - env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          REPOSITORY: ${{ github.repository }}
+          SOURCE_PATTERN: ^\.github/cdk/main\.ts$
+        name: Write the source files to the pull request branch
+        run: |-
+          set -euo pipefail
+          root="$RUNNER_TEMP/action-pin-sync"
+          expected_head="$HEAD_SHA"
+          while IFS= read -r -d '' file; do
+            case "$file" in
+              /* | ../* | */../* | */.. | ..) echo "::error::Refusing path $file"; exit 1 ;;
+            esac
+            if ! printf '%s' "$file" | grep -Eq "$SOURCE_PATTERN"; then
+              echo "::error::$file is not one of the configured sources"; exit 1
+            fi
+            if [ ! -f "$root/files/$file" ] || [ -L "$root/files/$file" ]; then
+              echo "::error::$file is not a regular file in the artifact"; exit 1
+            fi
+            head=$(gh api "repos/$REPOSITORY/git/ref/heads/$HEAD_REF" --jq .object.sha)
+            if [ "$head" != "$expected_head" ]; then
+              echo "::error::$HEAD_REF moved to $head after $expected_head; not overwriting it"; exit 1
+            fi
+            blob=$(gh api "repos/$REPOSITORY/contents/$file?ref=$expected_head" --jq .sha)
+            expected_head=$(gh api -X PUT "repos/$REPOSITORY/contents/$file" \
+              -f message="chore(deps): carry action bumps into the workflow source" \
+              -f content="$(base64 -w0 "$root/files/$file")" \
+              -f branch="$HEAD_REF" \
+              -f sha="$blob" \
+              --jq .commit.sha)
+            echo "Wrote $file in $expected_head"
+          done < "$root/paths"
+  regenerate:
+    if: (github.event.pull_request.user.login == 'dependabot[bot]' && github.actor == 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)
+    outputs:
+      artifactId: ${{ steps.upload.outputs.artifact-id }}
+      changed: ${{ steps.changes.outputs.changed }}
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - id: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha }}
+      - id: setup-node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
+        with:
+          node-version: "24"
+      - name: Install
+        run: corepack enable && yarn --cwd .github/cdk install --immutable
+      - env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        name: Carry the bumps into the source
+        run: .github/cdk/node_modules/.bin/cdkactions sync-action-pins --base "$BASE_SHA" --workflows '.github/workflows' '.github/cdk/main.ts'
+      - name: Verify each versioned pin against its tag
+        run: .github/cdk/node_modules/.bin/cdkactions verify-action-pins '.github/cdk/main.ts'
+      - name: Synthesize
+        run: yarn --cwd .github/cdk build
+      - name: Check the source reproduces the workflows
+        run: git diff --exit-code -- '.github/workflows'
+      - id: changes
+        name: Collect the changed source files
+        run: |-
+          git diff --name-only -z -- ':(glob).github/cdk/main.ts' > "$RUNNER_TEMP/changed-sources"
+          if [ ! -s "$RUNNER_TEMP/changed-sources" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          mkdir -p "$RUNNER_TEMP/action-pin-sync/files"
+          cp "$RUNNER_TEMP/changed-sources" "$RUNNER_TEMP/action-pin-sync/paths"
+          xargs -0 cp --parents -t "$RUNNER_TEMP/action-pin-sync/files" < "$RUNNER_TEMP/changed-sources"
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+      - id: upload
+        if: steps.changes.outputs.changed == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+        with:
+          if-no-files-found: error
+          include-hidden-files: true
+          name: action-pin-sync
+          path: ${{ runner.temp }}/action-pin-sync
+          retention-days: 1

.github/workflows/cdkactions_update-nixpkgs.yaml

@@ -14,10 +14,12 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - id: checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Install Nix
         uses: DeterminateSystems/determinate-nix-action@d0c908e6cbe9f89f36ed8205a3ab6f092636916a
-      - name: Update nixpkgs and open pull request
+      - id: update-flake-lock
+        name: Update nixpkgs and open pull request
         uses: DeterminateSystems/update-flake-lock@da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3
         with:
           branch: chore/update-nixpkgs