From bc928c07be5c5dc7c9b9c33dfc5d8d68be260eb7 Mon Sep 17 00:00:00 2001 From: Mark Dickinson Date: Wed, 8 Jul 2026 09:26:52 +0100 Subject: [PATCH] ci: pin third-party GitHub Actions to commit SHAs Pin all external GitHub Actions to immutable commit SHAs (with a trailing version comment) rather than mutable version tags, following GitHub's security-hardening guidance. A mutable tag such as @v6 can be retargeted at malicious code if the action's repository is compromised (as in the March 2025 tj-actions/changed-files incident); a full commit SHA is immutable, so each run is reproducible and immune to tag-move attacks. Also add a 7-day Dependabot cooldown so action updates aren't picked up until they have been published for a week. Dependabot continues to maintain the pins, bumping both the SHA and the version comment. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 2 ++ .github/workflows/check-style-strict.yml | 4 ++-- .github/workflows/ets-from-source.yml | 8 ++++---- .github/workflows/publish-on-pypi.yml | 4 ++-- .github/workflows/test-minimal-dependencies.yml | 4 ++-- .github/workflows/test-with-edm.yml | 8 ++++---- .github/workflows/test-with-pip.yml | 4 ++-- 7 files changed, 18 insertions(+), 16 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5ace4600..6cc00712 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,5 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/workflows/check-style-strict.yml b/.github/workflows/check-style-strict.yml index 3279fedf..bce23c77 100644 --- a/.github/workflows/check-style-strict.yml +++ b/.github/workflows/check-style-strict.yml @@ -7,8 +7,8 @@ jobs: runs-on: 'ubuntu-latest' steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' cache: 'pip' diff --git a/.github/workflows/ets-from-source.yml b/.github/workflows/ets-from-source.yml index c7a98b40..7dce82e1 100644 --- a/.github/workflows/ets-from-source.yml +++ b/.github/workflows/ets-from-source.yml @@ -21,9 +21,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Checkout the target commit - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set up bootstrap Python (3.10) - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.10' cache: 'pip' @@ -31,12 +31,12 @@ jobs: - name: Install necessary packages to the bootstrap environment run: python -m pip install -r .github/workflows/bootstrap-requirements.txt - name: Cache EDM packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache key: ${{ runner.os }}-${{ matrix.runtime }}-${{ hashFiles('etstool.py') }} - name: Setup EDM - uses: enthought/setup-edm-action@v4.2 + uses: enthought/setup-edm-action@e68a4e0282298d695020fb21b4d3e93c3ac3c11f # v4.2 with: edm-version: ${{ env.INSTALL_EDM_VERSION }} - name: Install test environment diff --git a/.github/workflows/publish-on-pypi.yml b/.github/workflows/publish-on-pypi.yml index a21511cb..ee641ad0 100644 --- a/.github/workflows/publish-on-pypi.yml +++ b/.github/workflows/publish-on-pypi.yml @@ -11,9 +11,9 @@ jobs: steps: - name: Check out the release commit - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.10' - name: Install Python packages needed for build and upload diff --git a/.github/workflows/test-minimal-dependencies.yml b/.github/workflows/test-minimal-dependencies.yml index 302d1ab9..430bc5c2 100644 --- a/.github/workflows/test-minimal-dependencies.yml +++ b/.github/workflows/test-minimal-dependencies.yml @@ -15,9 +15,9 @@ jobs: steps: - name: Get apptools source - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} - name: Install local package diff --git a/.github/workflows/test-with-edm.yml b/.github/workflows/test-with-edm.yml index 0e6d0287..b3e61465 100644 --- a/.github/workflows/test-with-edm.yml +++ b/.github/workflows/test-with-edm.yml @@ -21,9 +21,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Checkout the target commit - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set up bootstrap Python (3.10) - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.12' cache: 'pip' @@ -31,12 +31,12 @@ jobs: - name: Install necessary packages to the bootstrap environment run: python -m pip install -r .github/workflows/bootstrap-requirements.txt - name: Cache EDM packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache key: ${{ runner.os }}-${{ matrix.runtime }}-${{ hashFiles('etstool.py') }} - name: Setup EDM - uses: enthought/setup-edm-action@v4.2 + uses: enthought/setup-edm-action@e68a4e0282298d695020fb21b4d3e93c3ac3c11f # v4.2 with: edm-version: ${{ env.INSTALL_EDM_VERSION }} - name: Install test environment diff --git a/.github/workflows/test-with-pip.yml b/.github/workflows/test-with-pip.yml index 02f4509b..f8ed9931 100644 --- a/.github/workflows/test-with-pip.yml +++ b/.github/workflows/test-with-pip.yml @@ -15,9 +15,9 @@ jobs: steps: - name: Get apptools source - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} - name: Install dependencies and local packages