ci: pin third-party GitHub Actions to commit SHAs - #171
Merged
Conversation
Pins 11 action reference(s) from mutable tags to the commit SHA they currently resolve to, keeping the tag as a trailing comment: uses: actions/checkout@v4 uses: actions/checkout@11d5960 # v4 A git tag is mutable -- whoever controls the action repo can repoint v4 at any commit, and every workflow picks it up on the next run with no change on our side. Actions run with GITHUB_TOKEN and access to repo secrets, so this is the same supply-chain exposure as an unpinned npm dependency, which is what prompted this sweep. GitHub's own hardening guide recommends SHA pinning for third-party actions. Every SHA was verified to be the commit the declared tag currently points at before committing. First-party realiotech/* reusable workflows are deliberately left on their branch: they are inside the trust boundary, and pinning them would require a PR in every consuming repo for each shared-workflow change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins 11 third-party action reference(s) from mutable tags to the commit SHA they currently resolve to.
Why
A git tag is mutable. Whoever controls the action repository can repoint
v4at any commit, and every workflow picks it up on the next run with no change on our side. Actions execute withGITHUB_TOKENand access to repository secrets — so this is the same class of exposure as an unpinned npm dependency, which is what prompted this sweep. It's also GitHub's own hardening recommendation.The tag is preserved as a trailing comment so the intent stays readable and Dependabot can still propose updates.
Verification
Every SHA was checked against the GitHub API to confirm it is the commit the declared tag currently points at — 19 distinct actions, all confirmed:
11d5960a49933ea5ca052bb5c94ce9fbAll workflow files re-parsed as valid YAML after rewriting.
Scope
First-party
realiotech/*reusable workflows are deliberately NOT pinned. They're inside the trust boundary, and they're intentionally tracked on a branch so one update propagates across the fleet — pinning them would mean a PR in every consuming repo for each shared-workflow change. That's real operational cost for no external-trust gain. Flagging it explicitly in case you'd rather pin those too.No behaviour change: each action runs the exact commit it was already running today.