From 7a0c9731cb73cc41d11c459063acdb85e3bed9d4 Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Wed, 29 Jul 2026 09:26:38 -0700 Subject: [PATCH] ci: pin every bare actions/*@vN reference to a full commit SHA (BE-5121) Seven workflow files still referenced first-party actions by mutable major tag, contrary to the repo rule in AGENTS.md ("Pin everything by full commit SHA, with a trailing '# vN' comment"). A moved tag silently changes what runs in CI here and, via the reusable workflows, for every consumer. Every SHA reuses the pin already present elsewhere in this repo for the same major version, and each was independently confirmed against the live tag with 'gh api repos/actions//commits/'. Same major versions as before, so no behaviour change is expected. --- .github/workflows/agents-md-integrity.yml | 6 +++--- .github/workflows/assign-prs-to-author.yml | 2 +- .../workflows/cursor-review-auto-label.yml | 2 +- .github/workflows/cursor-review.yml | 20 +++++++++---------- .../workflows/test-agents-md-integrity.yml | 4 ++-- .github/workflows/test-bump-callers.yml | 2 +- .../workflows/test-cursor-review-scripts.yml | 4 ++-- 7 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/agents-md-integrity.yml b/.github/workflows/agents-md-integrity.yml index 1890bff..32bdcf0 100644 --- a/.github/workflows/agents-md-integrity.yml +++ b/.github/workflows/agents-md-integrity.yml @@ -120,14 +120,14 @@ jobs: contents: read steps: - name: Checkout caller repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false - name: Load integrity check script # The checker comes from THIS repo (public, pinned via workflows_ref), # never from the caller's checkout, so a PR can't rewrite the check. - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: Comfy-Org/github-workflows ref: ${{ inputs.workflows_ref }} @@ -135,7 +135,7 @@ jobs: persist-credentials: false - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.12' diff --git a/.github/workflows/assign-prs-to-author.yml b/.github/workflows/assign-prs-to-author.yml index 783e903..4fe3149 100644 --- a/.github/workflows/assign-prs-to-author.yml +++ b/.github/workflows/assign-prs-to-author.yml @@ -45,7 +45,7 @@ jobs: issues: write steps: - name: Assign unassigned PRs to their authors - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const skipBots = ${{ inputs.skip-bots }}; diff --git a/.github/workflows/cursor-review-auto-label.yml b/.github/workflows/cursor-review-auto-label.yml index 65d87ab..0dcd01e 100644 --- a/.github/workflows/cursor-review-auto-label.yml +++ b/.github/workflows/cursor-review-auto-label.yml @@ -89,7 +89,7 @@ jobs: steps: - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }} diff --git a/.github/workflows/cursor-review.yml b/.github/workflows/cursor-review.yml index cac1da2..da4ae26 100644 --- a/.github/workflows/cursor-review.yml +++ b/.github/workflows/cursor-review.yml @@ -260,7 +260,7 @@ jobs: within_cap: ${{ steps.count.outputs.within_cap }} steps: - name: Checkout PR repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 persist-credentials: false @@ -456,7 +456,7 @@ jobs: PY - name: Checkout PR repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 persist-credentials: false @@ -466,7 +466,7 @@ jobs: # pinned via workflows_ref) — never from the PR checkout, so a # malicious PR can't rewrite the prompt to exfiltrate the diff or # smuggle instructions to the model. - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: Comfy-Org/github-workflows ref: ${{ inputs.workflows_ref }} @@ -567,7 +567,7 @@ jobs: - name: Upload findings artifact if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: findings-${{ matrix.review_type }}-${{ matrix.model }} path: /tmp/findings-out/findings.json @@ -587,13 +587,13 @@ jobs: pull-requests: write steps: - name: Checkout PR repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 persist-credentials: false - name: Load cursor-review assets - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: Comfy-Org/github-workflows ref: ${{ inputs.workflows_ref }} @@ -615,7 +615,7 @@ jobs: echo "$HOME/.cursor/bin" >> "$GITHUB_PATH" - name: Download panel findings - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: path: /tmp/panel pattern: findings-* @@ -820,7 +820,7 @@ jobs: - name: Mint bot-identity token (optional) id: bot_token if: ${{ inputs.bot_app_id != '' }} - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ inputs.bot_app_id }} private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }} @@ -877,7 +877,7 @@ jobs: contents: read steps: - name: Load cursor-review assets - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: Comfy-Org/github-workflows ref: ${{ inputs.workflows_ref }} @@ -931,7 +931,7 @@ jobs: contents: read steps: - name: Load cursor-review assets - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: Comfy-Org/github-workflows ref: ${{ inputs.workflows_ref }} diff --git a/.github/workflows/test-agents-md-integrity.yml b/.github/workflows/test-agents-md-integrity.yml index d9527a0..3db6664 100644 --- a/.github/workflows/test-agents-md-integrity.yml +++ b/.github/workflows/test-agents-md-integrity.yml @@ -27,12 +27,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.12' diff --git a/.github/workflows/test-bump-callers.yml b/.github/workflows/test-bump-callers.yml index beb7086..d07b628 100644 --- a/.github/workflows/test-bump-callers.yml +++ b/.github/workflows/test-bump-callers.yml @@ -41,7 +41,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false diff --git a/.github/workflows/test-cursor-review-scripts.yml b/.github/workflows/test-cursor-review-scripts.yml index fde5e6e..cac0340 100644 --- a/.github/workflows/test-cursor-review-scripts.yml +++ b/.github/workflows/test-cursor-review-scripts.yml @@ -25,12 +25,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.12'