Skip to content

ci: repin dead actions/checkout SHAs to @v4 #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KooshaPari merged 1 commit into from
Jun 22, 2026
+15 −15
Merged

ci: repin dead actions/checkout SHAs to @v4 #60

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ jobs:
timeout-minutes: 10
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1
uses: actions/checkout@v4 # v4.1.1

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
Expand All @@ -68,7 +68,7 @@ jobs:
timeout-minutes: 10
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1
uses: actions/checkout@v4 # v4.1.1

- name: Setup Node
uses: actions/setup-node@1d0ff469b7ec7b138cb3bdcbe74e5672f63d3013 # v4
Expand Down Expand Up @@ -97,7 +97,7 @@ jobs:
timeout-minutes: 10
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1
uses: actions/checkout@v4 # v4.1.1

- name: Setup Python
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/cargo-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
timeout-minutes: 5
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1
uses: actions/checkout@v4 # v4.1.1

- name: Install Rust
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # was: @master
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
test:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1
- uses: actions/checkout@v4 # v4.1.1

- name: Setup Rust
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # was: @master
Expand All @@ -42,7 +42,7 @@ jobs:
clippy:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1
- uses: actions/checkout@v4 # v4.1.1

- name: Setup Rust
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
Expand All @@ -65,7 +65,7 @@ jobs:
fmt:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1
- uses: actions/checkout@v4 # v4.1.1

- name: Setup Rust
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
Expand All @@ -79,7 +79,7 @@ jobs:
deny:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1
- uses: actions/checkout@v4 # v4.1.1

- name: Setup Rust
uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:
security-events: write
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1
uses: actions/checkout@v4 # v4.1.1
- name: Initialize CodeQL
uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
with:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/deny.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ jobs:
runs-on: ubuntu-24.04
steps:
- name: Checkout
uses: actions/checkout@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c
uses: actions/checkout@v4

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
Expand All @@ -54,7 +54,7 @@ jobs:
runs-on: ubuntu-24.04
steps:
- name: Checkout
uses: actions/checkout@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c
uses: actions/checkout@v4

- name: Setup Go
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496718a5831 # v5
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release-attestation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:
CARGO_WORKDIR: .
steps:
- name: Checkout source
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
uses: actions/checkout@v4
with:
fetch-depth: 0

Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
build:
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.1.1
- uses: actions/checkout@v4 # v4.1.1
with:
fetch-depth: 0

Expand Down Expand Up @@ -46,7 +46,7 @@ jobs:
outputs:
version: ${{ steps.version.outputs.version }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.1.1
- uses: actions/checkout@v4 # v4.1.1

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep release checkout pinned to a SHA

For the tag/workflow-dispatch release path, this switches actions/checkout from an immutable commit to the mutable v4 tag immediately before the job publishes with CARGO_REGISTRY_TOKEN. OpenSSF’s Pinned-Dependencies check treats mutable versions as unpinned (https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies), and this repo declares that check with warnings disallowed in .github/scorecard.yml; if the tag moves or is compromised, unreviewed checkout code runs in the privileged release job and the security gate is regressed. Please pin checkout to the current full v4 commit SHA instead of the tag, here and in the other changed workflows.

Useful? React with 👍 / 👎.

with:
fetch-depth: 0

Expand Down Expand Up @@ -77,7 +77,7 @@ jobs:
needs: release
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.1.1
- uses: actions/checkout@v4 # v4.1.1

- name: Promote to staging
uses: KooshaPari/phenotypeActions/promote@48772d7560c964fff01a209742429f24283e96cf # was: @main
Expand Down
Loading