From adf21d1a0703a0669d1da053998103805bffb5eb Mon Sep 17 00:00:00 2001 From: forkwright Date: Mon, 24 Aug 2026 19:48:41 -0500 Subject: [PATCH] fix(ci): name the major each pinned action sha actually is Seven action pins here carried a comment naming a different major than the sha resolves to: five `actions/checkout # v6` whose sha is v7.0.1, and one `actions/upload-artifact # v4` whose sha is v7. The comment is the only human-readable part of a sha pin -- nobody audits `3d3c42e5` directly -- so one naming the wrong major answers the audit question confidently and wrongly. That is worse than no comment. Nothing here is a version change: every sha is untouched. Only the comments move, to say what the shas already were. Cause, for the next reader: dependabot rewrites a pin comment only when it can parse a precise version out of the existing one. A pin whose comment reads `# v6` gives it nothing to rewrite, so a bump across a major boundary updates the sha and leaves the comment behind, silently and permanently. checkout gets `# v7.0.1` because that sha resolves to a precise release. upload-artifact gets `# v7` because upstream publishes only a moving major tag there -- naming a precise version it does not offer would be inventing one. Verified with utilities/check-action-pin-comments.py: 21 pins checked here, 0 naming the wrong major after this change. Fleet-wide the same check found ten, seven of which were in this repo. --- .github/workflows/fuzz.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- .github/workflows/security.yml | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index eb0eebb..3fb55e9 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -39,7 +39,7 @@ jobs: matrix: target: [frame_decode, message_parse, routing_decision] steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -75,7 +75,7 @@ jobs: # run tells you it failed and destroys the input that proves it. - name: Upload crash artifacts if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: fuzz-artifacts-${{ matrix.target }} path: fuzz/artifacts/ diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b708d8f..546e11e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -41,7 +41,7 @@ jobs: cross: true runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 46181a8..c593e8a 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -49,7 +49,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false # PROJECT: security hardening — never expose token to steps - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 @@ -83,7 +83,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 @@ -112,7 +112,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install pinned osv-scanner