pin actions and include helper Makefile (#51)

Author: aaronhurt

.github/workflows/status-checks.yaml

@@ -14,8 +14,8 @@ jobs:
     name: runner / misspell
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: reviewdog/action-misspell@v1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
+      - uses: reviewdog/action-misspell@9daa94af4357dddb6fd3775de806bc0a8e98d3e4 # ratchet:reviewdog/action-misspell@v1
         with:
           level: info
           reporter: github-check
@@ -26,8 +26,8 @@ jobs:
     name: runner / typos
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: reviewdog/action-typos@v1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
+      - uses: reviewdog/action-typos@627388e238f182b925d9acd151432f9b68f1d666 # ratchet:reviewdog/action-typos@v1
         with:
           level: info
           reporter: github-check
@@ -37,8 +37,8 @@ jobs:
     name: runner / markdownlint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: reviewdog/action-markdownlint@v0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
+      - uses: reviewdog/action-markdownlint@3667398db9118d7e78f7a63d10e26ce454ba5f58 # ratchet:reviewdog/action-markdownlint@v0
         with:
           level: info
           reporter: github-check
@@ -48,8 +48,8 @@ jobs:
     name: runner / shfmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: reviewdog/action-shfmt@v1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
+      - uses: reviewdog/action-shfmt@d8f080930b9be5847b4f97e9f4122b81a82aaeac # ratchet:reviewdog/action-shfmt@v1
         with:
           level: info
           filter_mode: nofilter
@@ -60,9 +60,9 @@ jobs:
     name: runner / shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
       - name: shellcheck
-        uses: reviewdog/action-shellcheck@v1
+        uses: reviewdog/action-shellcheck@5ebd09ddbe2ebb471646ce234c6c8dd18663ca7c # ratchet:reviewdog/action-shellcheck@v1
         with:
           level: info
           reporter: github-check
@@ -75,7 +75,7 @@ jobs:
     name: unit tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
       - run: cd test && ./test.sh
         env:
           TMPDIR: ${{ runner.temp }}

Makefile

@@ -0,0 +1,45 @@
+.PHONY: check pin unpin update upgrade switch switch-tags test-actions
+
+## The paths to search for yaml files.
+PATHS := actions .github/workflows
+## The yaml files from above paths up to 2 levels deep.
+FILES := $(foreach path, $(PATHS), $(wildcard $(path)/*.yaml $(path)/*/*.yaml))
+
+## help: Show Makefile targets. This is the default target.
+help:
+	@echo "Available Targets:\n"
+	@egrep '^## .+?:' ${MAKEFILE_LIST} | column -t -s ':' | sed -e 's,^## ,,'
+
+## check: Check for pinned uses values.
+check:
+	@ratchet check $(FILES)
+
+## pin: Pin any unpinned uses values.
+pin:
+	@ratchet pin $(FILES)
+
+## unpin: Unpin previously pinned items and revert back to previous value.
+unpin:
+	@ratchet unpin $(FILES)
+
+## update: Update pinned uses values to the latest commit matching the unpinned reference.
+update:
+	@ratchet update $(FILES)
+
+## upgrade: Upgrade pinned uses values to the latest available upstream reference commit.
+upgrade:
+	@ratchet upgrade $(FILES)
+
+## Set container_arch to the desired architecture for testing.
+set-container-arch:
+container_arch := linux/amd64
+ifeq ($(shell uname -s),Darwin)
+ifeq ($(shell uname -m),arm64)
+	container_arch := linux/arm64
+endif
+endif
+
+## test: Run github action "tests" job locally.
+test: set-container-arch
+	act --container-architecture="$(container_arch)" \
+	--job tests --rm