Skip to content

Support for basic statically resolvable expressions in container field #236

Open

Description

@Andrej730

Hi! When running gh actions-lock --verify , I get the warning below.

! container image `${{ matrix.container }}` is chosen at runtime, so the lockfile can't check it
  ↳ used by .github/workflows/build-ifcopenshell-linux.yml: job build container
  ↳ use a literal image pinned by digest where possible, or pin each value of the matrix or input by digest

Though this is mentioned in limitations in readme (This includes images chosen by a ${{ }} expression), is there any chance container can support resolving expressions that refer to static matrices?

In my case matrix is fully defined statically, so it's possible to infer the container value.

Otherwise to resolve this warning I need to drop matrices completely for such cases and instead split action in 2 jobs - either by moving the entire job code to a composite action or by using YAML anchors (e.g. steps: &build-steps in one job and steps: *build-steps in another).
Both result in less idiomatically written actions.

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch_suffix: linux64
            runner: ubuntu-22.04
            container:
              image: rockylinux:9@sha256:…
          - arch_suffix: linuxarm64
            runner: ubuntu-22.04-arm
            container:
              image: rockylinux/rockylinux:10@sha256:…
              env:
                PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
    name: build (${{ matrix.arch_suffix }})
    runs-on: ${{ matrix.runner }}
    container: ${{ matrix.container }}

Activity

  1. changed the title [-]Support for basic expressions in `container` field[/-] [+]Support for statically resolvable expressions in `container` field[/+] on Oct 22, 2026
  2. changed the title [-]Support for statically resolvable expressions in `container` field[/-] [+]Support for basic statically resolvable expressions in `container` field[/+] on Oct 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions