From baed5d0a2233805d6c0cdd851b125f7659f77af2 Mon Sep 17 00:00:00 2001 From: ErenAri Date: Wed, 15 Jul 2026 17:45:05 +0300 Subject: [PATCH] feat(action): use prebuilt release binaries for commit-SHA pins MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pinning third-party actions by full commit SHA is the recommended (and maintainer-requested) practice, but the prebuilt-binary resolution only matched v* tag refs — a SHA pin silently fell back to building the validator from source, which fails on runners without libbpf-dev (bpf/bpf.h: No such file or directory). This is exactly what broke the falcosecurity/libs lane's first dress-rehearsal run. When the action ref is a 40-hex commit SHA, resolve it to the release tag pointing at that commit via the tags API (authenticated with the workflow's github.token to avoid shared-runner rate limits) and use that release's checksum-verified prebuilt binaries. No matching tag, missing jq, or any API hiccup falls through to the existing build-from-source path unchanged; prebuilt: never still forces source. Also bump quickstart's stale v0.2.0 action pins to v0.3.0 and document the build-from-source dep list. Verified locally by executing the step body verbatim with ACTION_REF=c7ef4fb… (the v0.3.0 commit): resolves to v0.3.0, downloads both assets, sha256sum -c passes, binaries installed; an unknown SHA falls through to source build. Co-Authored-By: Claude Opus 4.8 --- action.yml | 22 +++++++++++++++++++++- docs/quickstart.md | 11 +++++++---- 2 files changed, 28 insertions(+), 5 deletions(-) diff --git a/action.yml b/action.yml index abe136b..e1b27b5 100644 --- a/action.yml +++ b/action.yml @@ -72,7 +72,7 @@ inputs: required: false default: "true" prebuilt: - description: Use prebuilt release binaries when the action is pinned to a release tag ("auto"), or always build from source ("never"). Downloads are checksum-verified against the release SHA256SUMS. + description: Use prebuilt release binaries when the action is pinned to a release tag or to a commit SHA that matches a release tag ("auto"), or always build from source ("never"). Downloads are checksum-verified against the release SHA256SUMS. required: false default: "auto" binary: @@ -89,10 +89,30 @@ runs: shell: bash env: ACTION_REF: ${{ github.action_ref }} + GITHUB_API_TOKEN: ${{ github.token }} run: | set -euo pipefail echo "resolved=false" >> "$GITHUB_OUTPUT" ref="${ACTION_REF:-}" + if [[ "$ref" =~ ^[0-9a-f]{40}$ ]] && command -v jq >/dev/null 2>&1; then + # Pinned by commit SHA (the recommended way to pin third-party + # actions). Resolve the commit to the release tag that points at it + # so SHA-pinned consumers still get prebuilt binaries instead of + # silently requiring libbpf build deps on the runner. Any API + # hiccup or no matching tag falls through to the source build. + tags_json="$(curl -fsSL --retry 2 \ + -H "Authorization: Bearer ${GITHUB_API_TOKEN}" \ + -H "Accept: application/vnd.github+json" \ + "https://api.github.com/repos/Kernel-Guard/bpfcompat/tags?per_page=100" || true)" + resolved_tag="$(printf '%s' "$tags_json" \ + | jq -r --arg sha "$ref" \ + '[.[] | select(.commit.sha == $sha) | .name | select(test("^v[0-9]"))][0] // empty' \ + 2>/dev/null || true)" + if [[ -n "$resolved_tag" ]]; then + echo "Commit ${ref} is release ${resolved_tag}; using its prebuilt binaries." + ref="$resolved_tag" + fi + fi if [[ ! "$ref" =~ ^v[0-9] ]]; then echo "Action not pinned to a release tag (ref: ${ref:-none}); building from source." exit 0 diff --git a/docs/quickstart.md b/docs/quickstart.md index 2595b60..d4728ac 100644 --- a/docs/quickstart.md +++ b/docs/quickstart.md @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest # exposes /dev/kvm for KVM acceleration steps: - uses: actions/checkout@v4 - - uses: Kernel-Guard/bpfcompat@v0.2.0 + - uses: Kernel-Guard/bpfcompat@v0.3.0 with: artifact: build/program.bpf.o # your compiled object matrix: matrices/mvp.yaml # the kernels you support @@ -57,7 +57,7 @@ What you get: Shipping a whole product? Use **suite mode** to gate a collection in one run: ```yaml - - uses: Kernel-Guard/bpfcompat@v0.2.0 + - uses: Kernel-Guard/bpfcompat@v0.3.0 with: suite: suites/project.yaml suite-out: reports/suite.json @@ -66,8 +66,11 @@ Shipping a whole product? Use **suite mode** to gate a collection in one run: The Action is on the [GitHub Marketplace](https://github.com/marketplace/actions/bpfcompat-ebpf-compatibility-gate). -Pinning to a release tag uses checksum-verified, attested prebuilt binaries -([verifying releases](verifying-releases.md)); otherwise it builds from source. +Pinning to a release tag — or to the commit SHA a release tag points at — uses +checksum-verified, attested prebuilt binaries +([verifying releases](verifying-releases.md)); otherwise it builds from source, +which needs `libbpf-dev`, `libelf-dev`, `zlib1g-dev`, and `pkg-config` on the +runner. ## 2. Run it locally (CLI)