From aa752d954a660e3489625e76e83aba2279cb58db Mon Sep 17 00:00:00 2001 From: Brian G Date: Fri, 18 Sep 2026 11:24:37 +0100 Subject: [PATCH] chore: pin GitHub Actions to commit SHAs Pin every `uses:` ref in .github/workflows and composite actions to a full 40-character commit SHA, with the original tag preserved as a comment, e.g. uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 Tags and branches are mutable; commit SHAs are not. Pinning to a SHA closes a supply-chain vector where a compromised action could replace what runs in CI without changing the tag we reference. Generated mechanically with `pinact run` (https://github.com/suzuki-shunsuke/pinact). No version bumps were applied (strict pin). --- .../check-merge-queue-changelogs/action.yml | 4 ++-- .github/actions/check-release/action.yml | 8 +++---- .github/workflows/changelog-check.yml | 2 +- .github/workflows/close-stale-release-prs.yml | 2 +- .github/workflows/create-update-issues.yml | 6 ++--- .../workflows/deploy-platform-api-docs.yml | 4 ++-- .../ensure-blocking-pr-labels-absent.yml | 4 ++-- .github/workflows/lint-build-test.yml | 22 +++++++++---------- .github/workflows/main.yml | 10 ++++----- .github/workflows/publish-preview.yml | 2 +- .github/workflows/publish-release.yml | 20 ++++++++--------- .../repair-dependabot-pull-requests.yml | 10 ++++----- .github/workflows/update-changelogs.yml | 14 ++++++------ 13 files changed, 54 insertions(+), 54 deletions(-) diff --git a/.github/actions/check-merge-queue-changelogs/action.yml b/.github/actions/check-merge-queue-changelogs/action.yml index 644844318c1..cd06120a307 100644 --- a/.github/actions/check-merge-queue-changelogs/action.yml +++ b/.github/actions/check-merge-queue-changelogs/action.yml @@ -12,14 +12,14 @@ runs: using: composite steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 with: fetch-depth: 0 persist-credentials: false - name: Get pull request number id: pr-number - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 env: HEAD_REF: ${{ github.event.pull_request.head.ref || github.event.merge_group.head_ref }} with: diff --git a/.github/actions/check-release/action.yml b/.github/actions/check-release/action.yml index f1f2196046d..d5490a48a5c 100644 --- a/.github/actions/check-release/action.yml +++ b/.github/actions/check-release/action.yml @@ -10,7 +10,7 @@ runs: using: composite steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false skip-install: true @@ -79,7 +79,7 @@ runs: - name: Check if the commit or pull request is a release id: is-release - uses: MetaMask/action-is-release@v2 + uses: MetaMask/action-is-release@3cd51b98fa98d1347d06f5961299b0172ee31ae8 # v2.3.0 with: commit-starts-with: ${{ inputs.commit-starts-with }} commit-message: ${{ github.event.pull_request.title }} @@ -198,7 +198,7 @@ runs: - name: Hide previous comments if: steps.is-release.outputs.IS_RELEASE == 'true' - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 env: PR_NUMBER: ${{ steps.pr-number.outputs.PR_NUMBER }} with: @@ -228,7 +228,7 @@ runs: - name: Reply on pull request if: steps.check-release.outputs.has-conflicts == 'true' - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 env: PACKAGE_NAMES: ${{ steps.check-release.outputs.package-names }} PR_NUMBER: ${{ steps.pr-number.outputs.PR_NUMBER }} diff --git a/.github/workflows/changelog-check.yml b/.github/workflows/changelog-check.yml index b6395b18192..2447f6c5b7a 100644 --- a/.github/workflows/changelog-check.yml +++ b/.github/workflows/changelog-check.yml @@ -13,7 +13,7 @@ jobs: pull-requests: read steps: - name: Check changelog - uses: MetaMask/github-tools/.github/actions/check-changelog@v1 + uses: MetaMask/github-tools/.github/actions/check-changelog@7e0d74bc7b79ce9601e52f58d5e4d36c19591df9 # v1.19.0 with: base-branch: ${{ github.event.pull_request.base.ref }} head-ref: ${{ github.head_ref }} diff --git a/.github/workflows/close-stale-release-prs.yml b/.github/workflows/close-stale-release-prs.yml index 91400419462..8b5b7e11ac4 100644 --- a/.github/workflows/close-stale-release-prs.yml +++ b/.github/workflows/close-stale-release-prs.yml @@ -24,7 +24,7 @@ jobs: pull-requests: write steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false - name: Close inactive release PRs diff --git a/.github/workflows/create-update-issues.yml b/.github/workflows/create-update-issues.yml index 8a18e5fca54..a0ef17013bb 100644 --- a/.github/workflows/create-update-issues.yml +++ b/.github/workflows/create-update-issues.yml @@ -15,14 +15,14 @@ jobs: id-token: write steps: - name: Checkout head - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Fetch tags run: git fetch --prune --unshallow --tags - name: Get extension token id: extension-token - uses: MetaMask/github-tools/.github/actions/get-token@v1 + uses: MetaMask/github-tools/.github/actions/get-token@7e0d74bc7b79ce9601e52f58d5e4d36c19591df9 # v1.19.0 with: token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }} target-repository: 'MetaMask/metamask-extension' @@ -32,7 +32,7 @@ jobs: metadata: read - name: Get mobile token id: mobile-token - uses: MetaMask/github-tools/.github/actions/get-token@v1 + uses: MetaMask/github-tools/.github/actions/get-token@7e0d74bc7b79ce9601e52f58d5e4d36c19591df9 # v1.19.0 with: token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }} target-repository: 'MetaMask/metamask-mobile' diff --git a/.github/workflows/deploy-platform-api-docs.yml b/.github/workflows/deploy-platform-api-docs.yml index 163da1b6c54..4b9f5f40e3f 100644 --- a/.github/workflows/deploy-platform-api-docs.yml +++ b/.github/workflows/deploy-platform-api-docs.yml @@ -13,7 +13,7 @@ jobs: contents: read steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: true persist-credentials: false @@ -29,7 +29,7 @@ jobs: - name: Get access token id: get-token - uses: MetaMask/github-tools/.github/actions/get-token@v1 + uses: MetaMask/github-tools/.github/actions/get-token@7e0d74bc7b79ce9601e52f58d5e4d36c19591df9 # v1.19.0 with: token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }} permissions: | diff --git a/.github/workflows/ensure-blocking-pr-labels-absent.yml b/.github/workflows/ensure-blocking-pr-labels-absent.yml index aec225298c6..cb275e58491 100644 --- a/.github/workflows/ensure-blocking-pr-labels-absent.yml +++ b/.github/workflows/ensure-blocking-pr-labels-absent.yml @@ -16,12 +16,12 @@ jobs: pull-requests: read steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false - name: Run command - uses: actions/github-script@v8 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 with: script: | if (context.payload.pull_request.labels.some((label) => label.name === 'DO-NOT-MERGE')) { diff --git a/.github/workflows/lint-build-test.yml b/.github/workflows/lint-build-test.yml index 0065ed68e48..557d36ad8b2 100644 --- a/.github/workflows/lint-build-test.yml +++ b/.github/workflows/lint-build-test.yml @@ -20,7 +20,7 @@ jobs: changed-paths: ${{ steps.packages.outputs.changed-paths }} steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false @@ -92,7 +92,7 @@ jobs: - readme-content:check steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false @@ -119,7 +119,7 @@ jobs: node-version: [24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false @@ -158,7 +158,7 @@ jobs: package-name: ${{ fromJson(needs.prepare.outputs.package-names) }} steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false @@ -183,7 +183,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Validate changelog diffs @@ -198,7 +198,7 @@ jobs: node-version: [24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false @@ -222,7 +222,7 @@ jobs: node-version: [24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false @@ -251,7 +251,7 @@ jobs: package-name: ${{ fromJson(needs.prepare.outputs.package-names) }} steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false @@ -278,7 +278,7 @@ jobs: package-name: ${{ fromJson(needs.prepare.outputs.package-names) }} steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false @@ -302,7 +302,7 @@ jobs: contents: read steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false @@ -325,7 +325,7 @@ jobs: node-version: [22.x, 24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false persist-credentials: false diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 0d60d95ba94..358ce3975f1 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -26,7 +26,7 @@ jobs: - name: Check pull request merge queue status id: check-skip-merge-queue if: github.event_name == 'merge_group' - uses: MetaMask/github-tools/.github/actions/check-skip-merge-queue@v1 + uses: MetaMask/github-tools/.github/actions/check-skip-merge-queue@7e0d74bc7b79ce9601e52f58d5e4d36c19591df9 # v1.19.0 check-workflows: name: Check workflows @@ -37,7 +37,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Download actionlint @@ -54,7 +54,7 @@ jobs: analyse-code: name: Analyse code needs: check-workflows - uses: MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@v2 + uses: MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@becb242930b3cc271c26da0280050db9c157e291 # v2.1.1 with: scanner-ref: v2 paths-ignored: | @@ -108,7 +108,7 @@ jobs: pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -127,7 +127,7 @@ jobs: IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }} steps: - id: is-release - uses: MetaMask/action-is-release@v2 + uses: MetaMask/action-is-release@3cd51b98fa98d1347d06f5961299b0172ee31ae8 # v2.3.0 with: commit-starts-with: ${{ vars.RELEASE_COMMIT_PREFIX }} diff --git a/.github/workflows/publish-preview.yml b/.github/workflows/publish-preview.yml index 5030117561c..cf8eb1bcc66 100644 --- a/.github/workflows/publish-preview.yml +++ b/.github/workflows/publish-preview.yml @@ -11,7 +11,7 @@ permissions: jobs: publish-preview: if: ${{ github.event.issue.pull_request && startsWith(github.event.comment.body, '@metamaskbot publish-preview') }} - uses: MetaMask/github-tools/.github/workflows/publish-preview.yml@v1 + uses: MetaMask/github-tools/.github/workflows/publish-preview.yml@7e0d74bc7b79ce9601e52f58d5e4d36c19591df9 # v1.19.0 with: environment: default-branch docs-url: 'https://github.com/MetaMask/core/blob/main/docs/processes/preview-builds.md' diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 077ddbd0cdb..3e2d0289dab 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: true persist-credentials: false @@ -29,7 +29,7 @@ jobs: - name: Build run: yarn build - name: Upload build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: publish-release-artifacts-${{ github.sha }} include-hidden-files: true @@ -44,18 +44,18 @@ jobs: needs: build steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: true persist-credentials: false ref: ${{ github.sha }} skip-install: true - name: Restore build artifacts - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: name: publish-release-artifacts-${{ github.sha }} - name: Dry run publish to NPM - uses: MetaMask/action-npm-publish@v6 + uses: MetaMask/action-npm-publish@18df42148c35aabb98e00f9fda127d421af141df # v6.5.0 with: dry-run: true slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }} @@ -71,18 +71,18 @@ jobs: id-token: write steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: true persist-credentials: false ref: ${{ github.sha }} skip-install: true - name: Restore build artifacts - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 with: name: publish-release-artifacts-${{ github.sha }} - name: Publish to NPM - uses: MetaMask/action-npm-publish@v6 + uses: MetaMask/action-npm-publish@18df42148c35aabb98e00f9fda127d421af141df # v6.5.0 with: dry-run: false npm-token: ${{ secrets.NPM_TOKEN }} @@ -95,12 +95,12 @@ jobs: needs: publish-npm steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: true persist-credentials: false ref: ${{ github.sha }} skip-install: true - - uses: MetaMask/action-publish-release@v3 + - uses: MetaMask/action-publish-release@f01f1be110d60fb07d86c880ce3d6bdb353524d3 # v3.3.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/repair-dependabot-pull-requests.yml b/.github/workflows/repair-dependabot-pull-requests.yml index 849aceef9a8..086a09801c9 100644 --- a/.github/workflows/repair-dependabot-pull-requests.yml +++ b/.github/workflows/repair-dependabot-pull-requests.yml @@ -23,7 +23,7 @@ jobs: # Dependabot runs get a read-only `GITHUB_TOKEN` and no repository secrets, so the push is authorised by an OIDC exchange instead. - name: Get access token id: get-token - uses: MetaMask/github-tools/.github/actions/get-token@v1 + uses: MetaMask/github-tools/.github/actions/get-token@7e0d74bc7b79ce9601e52f58d5e4d36c19591df9 # v1.19.0 with: token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }} permissions: | @@ -31,7 +31,7 @@ jobs: # Explicitly the head branch, because on a `pull_request` event the default checkout is the merge ref and we push this branch back. Full history is for the merge base below. - name: Check out the pull request branch - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.ref }} fetch-depth: 0 @@ -55,13 +55,13 @@ jobs: # The action installs with an explicit `yarn --immutable`, which Dependabot's lockfile does not always satisfy. Every install in this job has to be free to rewrite it, so do our own. - name: Set up environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false skip-install: true - name: Install dependencies - uses: MetaMask/action-retry-command@v1 + uses: MetaMask/action-retry-command@2377689bfd9a03010a956b7c14273a2fc43d20cf # v1.0.1 with: command: yarn install --no-immutable max-retries: 5 @@ -72,7 +72,7 @@ jobs: run: yarn constraints --fix - name: Apply dependency range updates - uses: MetaMask/action-retry-command@v1 + uses: MetaMask/action-retry-command@2377689bfd9a03010a956b7c14273a2fc43d20cf # v1.0.1 with: command: yarn install --no-immutable max-retries: 5 diff --git a/.github/workflows/update-changelogs.yml b/.github/workflows/update-changelogs.yml index 1c88bb578ca..498f6a469a7 100644 --- a/.github/workflows/update-changelogs.yml +++ b/.github/workflows/update-changelogs.yml @@ -62,7 +62,7 @@ jobs: >> "$GITHUB_OUTPUT" - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0 @@ -82,7 +82,7 @@ jobs: - name: Check if the pull request is a release id: is-release - uses: MetaMask/action-is-release@v2 + uses: MetaMask/action-is-release@3cd51b98fa98d1347d06f5961299b0172ee31ae8 # v2.3.0 with: commit-starts-with: ${{ vars.RELEASE_COMMIT_PREFIX }} commit-message: ${{ steps.pr-info.outputs.pr-title }} @@ -101,7 +101,7 @@ jobs: steps: - name: Get access token id: get-token - uses: MetaMask/github-tools/.github/actions/get-token@v1 + uses: MetaMask/github-tools/.github/actions/get-token@7e0d74bc7b79ce9601e52f58d5e4d36c19591df9 # v1.19.0 with: token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }} permissions: | @@ -131,7 +131,7 @@ jobs: steps: - name: Get access token id: get-token - uses: MetaMask/github-tools/.github/actions/get-token@v1 + uses: MetaMask/github-tools/.github/actions/get-token@7e0d74bc7b79ce9601e52f58d5e4d36c19591df9 # v1.19.0 with: token-exchange-url: ${{ vars.TOKEN_EXCHANGE_URL }} permissions: | @@ -139,7 +139,7 @@ jobs: pull_requests: write - name: Check out the base branch - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.is-release.outputs.merge-base }} token: ${{ steps.get-token.outputs.token }} @@ -149,7 +149,7 @@ jobs: run: git checkout --detach HEAD - name: Set up environment - uses: MetaMask/action-checkout-and-setup@v3 + uses: MetaMask/action-checkout-and-setup@0543b5929698c71e3ccc6ed24eac87825669b5de # v3.5.0 with: is-high-risk-environment: false @@ -230,7 +230,7 @@ jobs: - name: Comment result if: always() - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: CHANGES_PUSHED: ${{ steps.push-changes.outputs.changes-pushed }} PUSH_CHANGES_OUTCOME: ${{ steps.push-changes.outcome }}