From f7a93d344f5c898999194a7e9a4b6fc710c55d46 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20Jare=C5=A1?= Date: Sat, 5 Sep 2026 11:45:07 +0200 Subject: [PATCH] Install PSScriptAnalyzer directly instead of via psmodulecache MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit sha_pinning_required applies to actions referenced inside composite actions, not just to the ones in our own workflows. potatoqualitee/psmodulecache is a composite action and its own actions/cache reference is not pinned: v6.2.1 uses actions/cache@v4.2.0 and v6.3 uses @v5.0.5. So the job fails at "Set up job" with The action actions/cache@v4.2.0 is not allowed in pester/Pester because all actions must be pinned to a full-length commit SHA. Taking the Dependabot bump to v6.3 does not help, it just moves to a different unpinned reference. We cannot pin someone else's internals, so the dependency goes. The step only installed PSScriptAnalyzer and ConvertToSARIF. Two modules from PSGallery take seconds, so the cache was not buying much, and dropping it removes the last blocker to turning sha_pinning_required back on. It was the only action we use with unpinned nested references, the other six are clean. 🤖 --- .github/workflows/code-analysis.yml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml index ff8ab0223..cf2a84d06 100644 --- a/.github/workflows/code-analysis.yml +++ b/.github/workflows/code-analysis.yml @@ -22,10 +22,17 @@ jobs: - name: Checkout code uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - - name: PowerShell Module Cache - uses: potatoqualitee/psmodulecache@ee5e9494714abf56f6efbfa51527b2aec5c761b8 # v6.2.1 - with: - modules-to-cache: PSScriptAnalyzer, ConvertToSARIF:1.0.0 + # Installed directly rather than through potatoqualitee/psmodulecache. That is a + # composite action and its own actions/cache reference is not pinned - v6.2.1 uses + # actions/cache@v4.2.0, v6.3 uses @v5.0.5 - and sha_pinning_required applies to + # nested references too, so the whole job fails while we depend on it. Two modules + # from PSGallery take seconds, so the cache was not buying much. + - name: Install PSScriptAnalyzer and ConvertToSARIF + shell: pwsh + run: | + Set-PSRepository -Name PSGallery -InstallationPolicy Trusted + Install-Module PSScriptAnalyzer -Force -SkipPublisherCheck -Scope CurrentUser + Install-Module ConvertToSARIF -RequiredVersion 1.0.0 -Force -Scope CurrentUser # Not using microsoft/psscriptanalyzer-action@v1.0 because we're missing psm1 in src + need to exclude generated ps1xml - name: Run PSScriptAnalyzer