actreg

Documentation

Overview

Package actreg resolves GitHub Actions workflow pins against the action repositories' real tag lists, fetched anonymously over git smart-HTTP (one GET per repository, no API rate limits — the same channel internal/taglink uses).

What it settles:

• a commit-SHA pin that equals a release tag is displayed as that release ("8f4b7f8… (=v4.2.2)") and vulnerability-matched as it;
• a floating major tag (v4) is resolved to the concrete release it currently points at, so advisories fixed inside the major don't false-positive;
• a SHA that matches NO tag, or a version-shaped ref that is not a tag in the repo, raises the unlisted flag: release tags are how actions ship, and the March-2025 tj-actions/changed-files attack pinned users to exactly such commits.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff) (bool, error)
• func Effective(c *diffx.Change, ref string) string
• func VersionLike(ref string) bool

Variables

var Concurrency = 8

Concurrency bounds parallel tag fetches.

var Enabled = true

Enabled gates the whole layer; the browser (wasm) build sets it to false — git smart-HTTP endpoints send no CORS headers.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff) (bool, error)

Annotate resolves workflow pins in place. ok reports whether at least one repository's tags were checked.

func Effective

func Effective(c *diffx.Change, ref string) string

Effective returns the version a pinned ref stands for: the resolved release tag when the repository's tags settled it, the raw ref otherwise.

func VersionLike

func VersionLike(ref string) bool

VersionLike reports whether a ref is shaped like a release version (v4, 4.2.2, v1.2.3-rc1) rather than a branch name or SHA.