Heal Dependabot hygiene from the pins catalog

.github/workflows/action-pins.yml

@@ -1,7 +1,8 @@
 # Single source of truth for third-party action pins. Dependabot only scans
 # `.github/workflows` and a root `action.yml`, so pins used elsewhere — the
 # composite actions, `ci:generate-workflow` — are listed here to keep them
-# updated. `mise run ci:check-action-pins` verifies every reference agrees.
+# updated. `mise run ci:check-action-pins` verifies every reference agrees, and
+# `mise run ci:fix-action-pins` copies catalog pins onto consumers.
 name: Action pins
 
 # Never runs. The trigger is a branch that is never created, and `!always()` is

.mise/tasks/ci/check-action-pins

@@ -19,8 +19,9 @@ def main() -> int:
     for problem in problems:
         print(f"error: {problem}", file=sys.stderr)
     print(
-        f"\nUpdate {CATALOG.as_posix()} and the references above so every action "
-        "resolves to one commit, then run `mise run ci:generate-workflow`.",
+        f"\nRun `mise run ci:fix-action-pins` to copy catalog pins onto consumers. "
+        f"Unpinned uses and unused catalog entries still require an edit of "
+        f"{CATALOG.as_posix()}.",
         file=sys.stderr,
     )
     return 1

.mise/tasks/ci/commit-hygiene-fixes

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# [MISE] description="Commit tracked files left dirty by mise run fix."
+set -euo pipefail
+cd "${MISE_PROJECT_ROOT:-$(cd "$(dirname "$0")/../../.." && pwd)}"
+
+committed=false
+git update-index -q --refresh
+if ! git diff --quiet || ! git diff --cached --quiet; then
+  git add --update
+  git -c user.name="github-actions[bot]" \
+    -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
+    commit --message "chore: apply hygiene fixes"
+  committed=true
+fi
+
+if [[ -n ${GITHUB_OUTPUT:-} ]]; then
+  echo "committed=${committed}" >> "${GITHUB_OUTPUT}"
+fi
+if [[ ${committed} == true ]]; then
+  echo "committed=true"
+else
+  echo "Tree already clean."
+fi
+
+if [[ -z ${GH_TOKEN:-} || -z ${HEAD_REF:-} ]]; then
+  exit 0
+fi
+if [[ ${committed} != true && $(git log -1 --pretty=%s) != "chore: apply hygiene fixes" ]]; then
+  exit 0
+fi
+git push
+# GITHUB_TOKEN pushes do not start new workflow runs, so dispatch CI on the
+# updated branch after the push.
+gh workflow run CI --ref "${HEAD_REF}"

.mise/tasks/ci/fix-action-pins

@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+# [MISE] description="Copy catalog action pins onto every consumer."
+# [MISE] shell="python"
+
+import pathlib
+import sys
+
+
+ROOT = pathlib.Path(__file__).resolve().parents[3]
+sys.path.insert(0, str(ROOT))
+
+from ci.action_pins import fix_pins  # noqa: E402
+
+
+def main() -> int:
+    changed = fix_pins(ROOT)
+    for path in changed:
+        print(f"updated {path.relative_to(ROOT).as_posix()}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.mise/tasks/ci/generate-workflow

@@ -68,13 +68,18 @@ def setup(
     zig: bool = False,
     gradle: bool = True,
     save_toolchains: bool = False,
+    checkout: bool = True,
 ) -> list[str]:
-    lines = [
-        f"      - uses: {CHECKOUT}",
-        "        with:",
-        "          persist-credentials: false",
-        "      - uses: ./.github/actions/setup-ci-deps",
-    ]
+    lines: list[str] = []
+    if checkout:
+        lines.extend(
+            [
+                f"      - uses: {CHECKOUT}",
+                "        with:",
+                "          persist-credentials: false",
+            ]
+        )
+    lines.append("      - uses: ./.github/actions/setup-ci-deps")
     if zig:
         lines.append("        id: setup")
     lines.append("        with:")
@@ -227,6 +232,10 @@ def render(source: dict[str, object], presets: dict[str, object]) -> str:
         "      - synchronize",
         "      - reopened",
         "      - ready_for_review",
+        # GITHUB_TOKEN pushes from Dependabot hygiene healing do not start
+        # pull_request workflows, so that job dispatches CI on the updated
+        # branch after it commits.
+        "  workflow_dispatch:",
         "",
         "permissions:",
         "  contents: read",
@@ -240,10 +249,23 @@ def render(source: dict[str, object], presets: dict[str, object]) -> str:
         "    name: hygiene",
         "    runs-on: ubuntu-latest",
         "    timeout-minutes: 30",
+        "    permissions:",
+        "      contents: write",
+        "      actions: write",
         SCCACHE_ENVIRONMENT,
         *gate(),
+        "    env:",
+        "      DEPENDABOT_PR: ${{ github.event_name == 'pull_request' && github.actor == 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository }}",
         "    steps:",
-        *setup(gradle=False),
+        f"      - uses: {CHECKOUT}",
+        "        if: env.DEPENDABOT_PR != 'true'",
+        "        with:",
+        "          persist-credentials: false",
+        f"      - uses: {CHECKOUT}",
+        "        if: env.DEPENDABOT_PR == 'true'",
+        "        with:",
+        "          ref: ${{ github.head_ref }}",
+        *setup(gradle=False, checkout=False),
         "      - run: mise run ci:generate-workflow --check",
         "      - run: mise run ci:generate-devcontainer-tools --check",
         "      - run: mise run ci:test-release-tools",
@@ -254,7 +276,14 @@ def render(source: dict[str, object], presets: dict[str, object]) -> str:
         # `mise run fix` provides the project-scoped formatter tools that the
         # dprint wrappers expect; calling hk directly leaves them uninstalled.
         "      - run: mise run fix",
+        "      - id: apply-fix",
+        "        if: env.DEPENDABOT_PR == 'true'",
+        "        env:",
+        "          GH_TOKEN: ${{ github.token }}",
+        "          HEAD_REF: ${{ github.head_ref }}",
+        "        run: mise run ci:commit-hygiene-fixes",
         "      - name: Check generated and formatted files",
+        "        if: steps.apply-fix.outputs.committed != 'true'",
         "        run: |",
         "          git update-index -q --refresh",
         "          git diff --exit-code -- . ':(exclude)mise*.lock'",

ci/action_pins.py

@@ -1,4 +1,4 @@
-"""Read and verify the third-party GitHub Actions pins catalog."""
+"""Read, verify, and rewrite the third-party GitHub Actions pins catalog."""
 
 from __future__ import annotations
 
@@ -106,3 +106,38 @@ def check_pins(root: pathlib.Path) -> list[str]:
             f"{CATALOG.as_posix()}: {action} is no longer used; remove the pin"
         )
     return problems
+
+
+# The SHA and version comment; indent, `- `, and `uses:` stay as they were.
+_PIN_REF = re.compile(r"@[0-9a-f]{40}\s+#\s*\S+")
+
+
+def _apply_pin(line: str, pin: Pin) -> str:
+    return _PIN_REF.sub(f"@{pin.sha} # {pin.version}", line, count=1)
+
+
+def fix_pins(root: pathlib.Path) -> list[pathlib.Path]:
+    """Rewrite consumer pins that disagree with the catalog.
+
+    Unpinned uses, actions missing from the catalog, and unused catalog
+    entries stay as they are. Those still fail ``check_pins``.
+    """
+    pins = catalog(root)
+    changed: list[pathlib.Path] = []
+    for path in consumers(root):
+        original = path.read_text()
+        rewritten: list[str] = []
+        dirty = False
+        for line in original.splitlines(keepends=True):
+            pinned = PINNED.match(line)
+            if pinned:
+                current = Pin(**pinned.groupdict())
+                expected = pins.get(current.action)
+                if expected is not None and current != expected:
+                    line = _apply_pin(line, expected)
+                    dirty = True
+            rewritten.append(line)
+        if dirty:
+            path.write_text("".join(rewritten), newline="\n")
+            changed.append(path)
+    return changed