ci: use gha lockefiles

.github/actionlint.yaml

@@ -1,3 +1,8 @@
+paths: # https://github.com/rhysd/actionlint/issues/711
+  .github/*/*.yml:
+    ignore:
+      - 'reusable workflow call "\$/\.github/workflows/[a-z0-9-]+\.yml" at "uses" is not following the format'
+      - 'specifying action "\$/\.github/actions/[a-z0-9-]+" in invalid format'
 self-hosted-runner:
   labels:
     - aarch64-darwin

.github/actions/install-nix/action.yml

@@ -35,7 +35,7 @@ runs:
         ROLE_TO_ASSUME: ${{ inputs.role-to-assume }}
 
     - name: configure aws credentials
-      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+      uses: aws-actions/configure-aws-credentials@v6.3.0
       if: steps.resolve-push-to-cache.outputs.value == 'true'
       with:
         role-to-assume: ${{ inputs.role-to-assume }}

.github/workflows/actions.lock

@@ -0,0 +1,250 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ami-release-nix.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'rtcamp/action-slack-notify@v2.4.0'
+        - 'softprops/action-gh-release@v3.0.3'
+    '.github/workflows/check-extension-versions.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'peter-evans/create-pull-request@v8.1.1'
+    '.github/workflows/cleanup-stale-ec2.yml':
+        - 'actions/checkout@v6.0.1'
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v4.3.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'slackapi/slack-github-action@v4.0.0'
+    '.github/workflows/cli-release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'softprops/action-gh-release@v3.0.3'
+    '.github/workflows/cli-smoke-test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+    '.github/workflows/docker-image-test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+    '.github/workflows/dockerhub-release-matrix.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'docker/build-push-action@v7.4.0'
+        - 'docker/login-action@v4.6.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+    '.github/workflows/manual-docker-release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'docker/build-push-action@v7.4.0'
+        - 'docker/login-action@v4.6.0'
+        - 'docker/setup-buildx-action@v4.4.1'
+    '.github/workflows/mirror-postgrest.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'mikefarah/yq@v4.54.1'
+    '.github/workflows/mirror.yml':
+        - 'akhilerm/tag-push-action@v2.3.0'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'docker/login-action@v4.6.0'
+    '.github/workflows/nix-build.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'peter-evans/create-or-update-comment@v5.0.0'
+        - 'peter-evans/find-comment@v4.0.0'
+    '.github/workflows/nix-dependency-analysis.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'peter-evans/create-or-update-comment@v5.0.0'
+        - 'peter-evans/find-comment@v4.0.0'
+    '.github/workflows/publish-migrations-prod.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+    '.github/workflows/publish-migrations-staging.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+    '.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'rtcamp/action-slack-notify@v2.4.0'
+    '.github/workflows/publish-nix-pgupgrade-scripts.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'rtcamp/action-slack-notify@v2.4.0'
+    '.github/workflows/qemu-image-build.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/amazon-ecr-login@v2.1.7'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'rtcamp/action-slack-notify@v2.4.0'
+    '.github/workflows/test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+    '.github/workflows/testinfra-ami-build.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+    '.github/workflows/update-flake-lock-non-critical.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'peter-evans/create-pull-request@v8.1.1'
+    '.github/workflows/update-flake-lock.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/create-github-app-token@v3.3.0'
+        - 'aws-actions/configure-aws-credentials@v6.3.0'
+        - 'determinatesystems/update-flake-lock@v29'
+dependencies:
+    'actions/checkout@v6.0.1':
+        ref: 'v6.0.1'
+        commit: 'sha1-8e8c483db84b4bee98b60c0593521ed34d9990e8'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/create-github-app-token@v3.3.0':
+        ref: 'v3.3.0'
+        commit: 'sha1-64ab729a6294000f5aa4a4bc0b73d1f32bc45510'
+        owner_id: 44036562
+        repo_id: 642580244
+    'actions/download-artifact@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'akhilerm/tag-push-action@v2.3.0':
+        ref: 'v2.3.0'
+        commit: 'sha1-eadeefebd39db8a47e146115649adae1fce576a6'
+        owner_id: 7610845
+        repo_id: 314832723
+    'aws-actions/amazon-ecr-login@v2.1.7':
+        ref: 'v2.1.7'
+        commit: 'sha1-03f1aad4c6c7ffd436567f42f9384779290529bd'
+        owner_id: 57468012
+        repo_id: 220389860
+    'aws-actions/configure-aws-credentials@v6.3.0':
+        ref: 'v6.3.0'
+        commit: 'sha1-e1253824e5c10ff9df46874f81ed3ec929e19cfd'
+        owner_id: 57468012
+        repo_id: 220391287
+    'crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd':
+        ref: 'v7.0.0'
+        commit: 'sha1-2dc316deee8e90f13e1a351ab510b4d5bc0c82cd'
+        owner_id: 1951866
+        repo_id: 260488959
+    'damianreeves/write-file-action@6929a9a6d1807689191dcc8bbe62b54d70a32b42':
+        ref: 'v1.3'
+        commit: 'sha1-6929a9a6d1807689191dcc8bbe62b54d70a32b42'
+        owner_id: 957246
+        repo_id: 258052107
+    'determinatesystems/update-flake-lock@v29':
+        ref: 'v29'
+        commit: 'sha1-da03c0f078bc4b2c37ee4f7e072d34bf8f188bb3'
+        owner_id: 80991770
+        repo_id: 418625766
+        uses:
+            - 'crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd'
+            - 'damianreeves/write-file-action@6929a9a6d1807689191dcc8bbe62b54d70a32b42'
+            - 'juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18'
+            - 'pedrolamas/handlebars-action@2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4'
+            - 'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1'
+    'docker/build-push-action@v7.4.0':
+        ref: 'v7.4.0'
+        commit: 'sha1-c3c9e263c25d99ce0380d002d59b67737d91b0dc'
+        owner_id: 5429470
+        repo_id: 241092383
+    'docker/login-action@v4.6.0':
+        ref: 'v4.6.0'
+        commit: 'sha1-dbcb813823bdd20940b903addbd779551569679f'
+        owner_id: 5429470
+        repo_id: 287743349
+    'docker/setup-buildx-action@v4.4.1':
+        ref: 'v4.4.1'
+        commit: 'sha1-f87e5991a6d7451dcb8d9637bfbc97413f497069'
+        owner_id: 5429470
+        repo_id: 288485773
+    'juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18':
+        ref: 'v1.1.8'
+        commit: 'sha1-271ff311a4947af354c6abcd696a306553b9ec18'
+        owner_id: 10247
+        repo_id: 244608449
+    'lovetoknow/slackify-markdown-action@698a1d4d0ff1794152a93c03ee8ca5e03a310d4e':
+        ref: 'v1.1.1'
+        commit: 'sha1-698a1d4d0ff1794152a93c03ee8ca5e03a310d4e'
+        owner_id: 168084
+        repo_id: 271813698
+    'mikefarah/yq@v4.54.1':
+        ref: 'v4.54.1'
+        commit: 'sha1-504fc38780cc46be8444ea1b72fb55919fc0bfb0'
+        owner_id: 1151925
+        repo_id: 43225113
+    'pedrolamas/handlebars-action@2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4':
+        ref: 'v2.4.0'
+        commit: 'sha1-2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4'
+        owner_id: 85504
+        repo_id: 304154389
+    'peter-evans/create-or-update-comment@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-e8674b075228eee787fea43ef493e45ece1004c9'
+        owner_id: 18365890
+        repo_id: 223708643
+    'peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1':
+        ref: 'v8.1.1'
+        commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1'
+        owner_id: 18365890
+        repo_id: 197176365
+    'peter-evans/create-pull-request@v8.1.1':
+        ref: 'v8.1.1'
+        commit: 'sha1-5f6978faf089d4d20b00c7766989d076bb2fc7f1'
+        owner_id: 18365890
+        repo_id: 197176365
+    'peter-evans/find-comment@v4.0.0':
+        ref: 'v4.0.0'
+        commit: 'sha1-b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad'
+        owner_id: 18365890
+        repo_id: 256447541
+    'rtcamp/action-slack-notify@v2.4.0':
+        ref: 'v2.4.0'
+        commit: 'sha1-33ca3be66c6f378fe1610fd1d5258632dbed5e58'
+        owner_id: 1128395
+        repo_id: 173934970
+        uses:
+            - 'lovetoknow/slackify-markdown-action@698a1d4d0ff1794152a93c03ee8ca5e03a310d4e'
+    'slackapi/slack-github-action@v4.0.0':
+        ref: 'v4.0.0'
+        commit: 'sha1-dcb1066f776dd043e64d0e8ba94ca15cc7e1875d'
+        owner_id: 6962987
+        repo_id: 306439799
+    'softprops/action-gh-release@v3.0.3':
+        ref: 'v3.0.3'
+        commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
+        owner_id: 2242
+        repo_id: 204253808

.github/workflows/ami-release-nix.yml

@@ -28,10 +28,10 @@ jobs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
 
       - name: Set PostgreSQL versions
         id: set-versions
@@ -59,7 +59,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+        uses: actions/checkout@v7.0.1
 
       - name: Debug AWS role secret
         run: |
@@ -71,15 +71,15 @@ jobs:
           fi
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
           output-credentials: true
           role-duration-seconds: 7200
 
       - name: Install nix
-        uses: ./.github/actions/install-nix
+        uses: $/.github/actions/install-nix
         with:
           push-to-cache: true
           aws-region: ${{ env.AWS_REGION }}
@@ -88,13 +88,13 @@ jobs:
 
       - name: Resolve git sha
         id: resolve-git-sha
-        uses: ./.github/actions/resolve-git-sha
+        uses: $/.github/actions/resolve-git-sha
         with:
           flake_input: ${{ vars.GIT_SHA_FROM_FLAKE_INPUT }}
 
       - name: Build AMI
         id: build-ami
-        uses: ./.github/actions/build-ami
+        uses: $/.github/actions/build-ami
         with:
           ami_name_prefix: ${{ matrix.target.ami_name_prefix }}
           ami_regions: '["${{ env.AWS_REGION }}"]'
@@ -136,7 +136,7 @@ jobs:
           tar -czf "/tmp/pg_binaries.tar.gz" -C "/tmp/pg_upgrade_bin" .
 
       - name: configure aws credentials - staging
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
@@ -148,7 +148,7 @@ jobs:
           aws s3 cp /tmp/pg_binaries.tar.gz "s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades$ARCH_SUFFIX/postgres/supabase-postgres-$POSTGRES_SUPABASE_VERSION/upgrade_bundle.tar.gz"
 
       - name: configure aws credentials - prod
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}
@@ -160,14 +160,14 @@ jobs:
           aws s3 cp /tmp/pg_binaries.tar.gz "s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades$ARCH_SUFFIX/postgres/supabase-postgres-$POSTGRES_SUPABASE_VERSION/upgrade_bundle.tar.gz"
 
       - name: GitHub OIDC Auth
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           aws-region: us-east-1
           role-to-assume: arn:aws:iam::279559813984:role/supabase-github-oidc-role
           role-session-name: shared-services-jump
 
       - name: Assume destination role
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           aws-region: us-east-1
           role-to-assume: arn:aws:iam::279559813984:role/supabase-nix-catalog-artifacts-role-6387512
@@ -204,7 +204,7 @@ jobs:
           echo "Catalog uploaded to ${CATALOG_S3}"
 
       - name: Create release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        uses: softprops/action-gh-release@v3.0.3
         with:
           name: ${{ env.RELEASE_TAG }}
           tag_name: ${{ env.RELEASE_TAG }}
@@ -245,7 +245,7 @@ jobs:
 
       - name: Slack Notification on Failure
         if: ${{ failure() }}
-        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
+        uses: rtCamp/action-slack-notify@v2.4.0
         env:
           SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
           SLACK_USERNAME: 'gha-failures-notifier'
@@ -255,7 +255,7 @@ jobs:
 
       - name: Configure AWS credentials for cleanup
         if: always()
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        uses: aws-actions/configure-aws-credentials@v6.3.0
         with:
           role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
           aws-region: ${{ env.AWS_REGION }}