This is an alternative to #3547 which avoids the regular expressions entirely. It does this by using the yaml library that we already use in sync.ts to:

• Parse the workflows in .github/workflows to extract the action versions
• Then parses, updates, and renders the workflow templates in pr-checks/checks

For sync.ts, I have extracted a mapping of action names to versions into a separate file (action-versions.ts) which can easily be re-generated by the sync_back.ts script.

A couple of extra notes for review:

• I looked into running eslint over the resulting action-versions.ts file, but this is currently sort-of blocked on me adding a tsconfig.json for pr-checks and then an eslint config. I'll do that, but separately from this.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Environments:

• Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

• Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
• End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Development/testing only - This change cannot cause any failures in production.

How will you know if something goes wrong after this change is released?

• Other - Please provide details.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.