From 222789f7ff77df4ebbde3683e8abec19776ac0e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Fri, 21 Aug 2026 10:23:21 +0200 Subject: [PATCH] ci: pin actions to full-length commit SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The org Actions policy requires every action to be pinned to a full-length commit SHA. The movable tags in this workflow are rejected before any job is created, so every run since 2026-08-21 07:51 UTC ended in `startup_failure` with no check-runs at all — on `main`, on PRs and on Dependabot branches alike: The actions actions/checkout@v7, actions/setup-node@v7, actions/upload-pages-artifact@v5, and actions/deploy-pages@v5 are not allowed in owncloud/docs.owncloud.com because all actions must be from a repository owned by owncloud, created by GitHub, or match one of the patterns: ... Pin all four to the commit of the release they already tracked, with the version in a trailing comment — the same convention as owncloud/docs, which pins the identical actions/checkout v7.0.1 and actions/setup-node v7.0.0 commits and is unaffected. Dependabot's github-actions ecosystem is already configured here, so the pins keep getting bumped. This also unblocks gating `main` on the `build` check: a startup failure produces no `build` check-run at all, so a required `build` context would block every merge. Co-Authored-By: Claude Opus 5 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .github/workflows/ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6293d79..144c458 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,10 +24,10 @@ jobs: cancel-in-progress: true steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '22' cache: npm @@ -46,7 +46,7 @@ jobs: - name: Upload Pages artifact if: github.ref == 'refs/heads/main' - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: path: public @@ -67,4 +67,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0