Repository navigation
chore(ci): pin every third-party GitHub Action to a commit SHA - #1587
Merged
Merged
Conversation
Replace the 98 uses: references that floated on a mutable tag with the full commit of a verified release and the version as a trailing comment, one pin per action across the workflows and the composite actions. The pins that already existed move to the same release where they were behind it. Co-Authored-By: jason.han <hanhuijun@gmail.com>
Contributor
Author
|
I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
…, no version moves Co-Authored-By: jason.han <hanhuijun@gmail.com>
5 of 6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Of the 140 third-party
uses:references under.github/and in the rootaction.yml, 98 floated on a mutable tag (actions/checkout@v4,actions/setup-go@v5,actions/upload-artifact@v4, …). A re-pointed tag changes what a build runs without any change in this repository, which is the cheapest unfixed hole in the build environment. Each floating reference now names the exact commit its tag resolves to today, with the release that commit is as a trailing comment (actions/checkout@11d5960a… # v4.4.0) — the form Dependabot'sgithub-actionsecosystem reads to move a pin (its config is a sibling change, not part of this PR). No version moves: every workflow keeps running the commit it ran yesterday, and the 42 references that were already SHA-pinned are untouched. Local actions (./,./.github/actions/corpora) are unchanged.actions/checkoutv411d5960a326750d5838078e36cf38b85af677262actions/setup-gov540f1582b2485089dde7abd97c1529aa768e1baffactions/setup-nodev449933ea5288caeca8642d1e84afbd3f7d6820020actions/upload-artifactv4ea165f8d65b6e75b540449e92b4886f43607fa02actions/cachev40057852bfaa89a56745cba8c7296529d2fc39830actions/download-artifactv4d3f86a106a0bac45b974a628896c90dbdf5c8093actions/setup-javav4cf277c60eb25467037889841efdb72551f06f6c3actions/setup-pythonv5a26af69be951a213d495a4c3e4e4022e16d87065actions/cache/restorev40057852bfaa89a56745cba8c7296529d2fc39830actions/cache/savev40057852bfaa89a56745cba8c7296529d2fc39830actions/configure-pagesv5983d7736d9b0ae728b81ab479565c72886d7745bactions/upload-pages-artifactv356afc609e74202658d3ffba0e8f6dda462b719faactions/deploy-pagesv4d6db90164ac5ed86f2b6aed7e0febac5b3c0c03egithub/codeql-action/upload-sarif(rootaction.yml)v49b3254085494b55a0f7c4c2b3d2d52cc712ce370Pre-existing pins, untouched and re-verified (tag still dereferences to the pinned commit):
actions/checkoutv5.0.0 ×7,actions/setup-gov6.0.0 ×3,actions/setup-nodev5.0.0 ×2,actions/setup-pythonv7.0.0 ×1,actions/upload-artifactv7.0.1 ×3,actions/download-artifactv8.0.1 ×3,softprops/action-gh-releasev2.3.3,signpath/github-action-submit-signing-requestv2.3,pypa/gh-action-pypi-publishv1.14.2,sigstore/cosign-installerv4.1.2,julia-actions/setup-juliav2.7.0. So six actions carry two pins (the major each workflow already used); bringing the v4/v5 majors up to the v5–v8 onesnightly.ymlandrelease-windows.ymlrun is a behaviour change (Node 24 runtime, new caching defaults) and is left to Dependabot.The secret-carrying and deploying workflows (
mcp-registry.yml,release-windows.yml,pages.yml) have no floating reference left;release-windows.ymlandmcp-registry.ymlwere already fully pinned and are unchanged.validate-action.ymlkeeps validating the rootaction.yml; its own checkout/setup-go steps are pinned.CONTRIBUTING.md § GitHub Actions gains one paragraph stating the pin form for new steps. Changelog fragment:
changes/unreleased/pin-github-actions.security.md.How it was verified
gh api repos/<o>/<r>/git/ref/tags/<tag>per floating tag (annotated tags dereferenced viagit/tags/<sha>), thengit/matching-refs/tags/<tag>.to name the release tag at the same commit.gh api repos/<o>/<r>/commits/<sha>resolves, and the tag in the comment dereferences to exactly that commit — 25/25identical.grep -rn "uses:.*@v[0-9]" .github action.yml— no floating reference left;git diff origin/develop --stat -- .github action.ymlis 107 one-line substitutions, nothing else.actionlintv1.7.12 (not in CI): the same two pre-existing shellcheck style notes inpr.ymlbefore and after, no new findings.go build ./...,go vet ./...,gofmt -l .(empty),go test ./tests/hygiene,python3 scripts/changelog.py check,scripts/ci-changed-areas-test.sh— all pass.Maintainer follow-ups
github-actionsconfig (sibling PR) is what moves these pins from here on.Checklist
make testandmake lintpass locally (workflow/docs-only change;go build,go vet,gofmt -l,tests/hygiene,changelog.py check,ci-changed-areas-test.sh,actionlintrun)changes/unreleased/<slug>.<section>.md, not as an edit toCHANGELOG.mdmake docs-countsrun if a gate count moved (no gate count moved)F4,K5) in the body, docs, or changelogLink to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/1cea005c16fa42d99890499890498fba
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/1cea005c16fa42d99890499890498fba?variant=devin
Requested by: @HuiJun