From f33d7a9a5b5cb58de07ea2f86d03f201bc9102ac Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 3 Jul 2026 14:47:27 +0000 Subject: [PATCH] ci: pin checkov-action to a commit SHA Every other action in .github/workflows/ is pinned to a full commit SHA with a version comment; bridgecrewio/checkov-action@v12 was the sole floating-tag exception, despite running with security-events: write on every PR and push to main. A mutable tag can be repointed to a different commit at any time. Resolved v12's current commit via the action repo's tags page and verified against its raw .patch header before pinning. --- .github/workflows/checkov.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/checkov.yml b/.github/workflows/checkov.yml index 25690bc..ab0ede6 100644 --- a/.github/workflows/checkov.yml +++ b/.github/workflows/checkov.yml @@ -20,7 +20,7 @@ jobs: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Run Checkov on Terraform modules - uses: bridgecrewio/checkov-action@v12 + uses: bridgecrewio/checkov-action@a7683e7b72a04503521247973281ec8142e1ac1f # v12 with: directory: modules/ framework: terraform