ci: pin GitHub Actions to commit SHAs - #1
Open
AlexaDeWit wants to merge 3 commits into
Open
Conversation
Part of Platform Engineering supply chain security hardening. Dependabot will keep these SHAs current automatically.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Pin all GitHub Actions in this repository to immutable commit SHAs.
Actions pinned to mutable tags or branch refs (e.g.
@v4,@main) are vulnerableto supply chain attacks — if an upstream maintainer's account is compromised, the tag
can be silently moved to a malicious commit and the next workflow run will execute it.
Dependabot is configured (or updated) in this PR to keep the pinned SHAs current
automatically, so this is a one-time migration with no ongoing manual maintenance.
Homebrew/actions/setup-homebrew@master@98cfa07b...actions/checkout@v2@ee0669bd...ilammy/msvc-dev-cmd@v1@0b201ec7...Reference
This PR was generated by the Platform Engineering
pin-actionstool as part of theorganisation-wide GitHub Actions supply chain hardening initiative (DO-1616).
Notes for reviewers
Ownership note: this PR was opened automatically on behalf of the team.
The author is a platform tooling script — merging is the responsibility of the
repository's code owners, not the platform team. Please review the pins and merge
at your convenience. Reach out to #platform-eng with any questions.
Each
uses:line has been updated fromowner/repo@tagtoowner/repo@sha # tag.The tag is preserved as an inline comment so the intent remains human-readable.
No workflow logic has been changed.
Validation
SHA resolution was performed at PR creation time via the GitHub API
(
GET /repos/{owner}/{repo}/commits/{ref}). Each SHA corresponds to the committhe tag pointed to at that moment. Dependabot will keep them up to date going forward.