security: pin GitHub Actions to full-length commit SHAs - #62
Merged
Conversation
Tags like `actions/checkout@v4` are mutable — whoever controls the action's repo can repoint the tag at different code, which then runs in CI with this repo's secrets. Pinning to a commit SHA makes the reference immutable. Each pin keeps a trailing comment with the version it resolved to, so the human-readable version is still visible. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
35 tasks
manuelwedler
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of the org-wide action pinning work (argotorg/sourcify#2898). Pins every GitHub Action in this repo to a full-length commit SHA.
Tags are mutable: whoever controls an action's repository can repoint
@v4at different code at any time, and that code then runs in CI with this repo's secrets. A commit SHA can't be repointed.Changed 2 workflow file(s): ci.yml publish.yml
Each pin keeps a trailing
# v4.4.0comment showing the version it resolved to, so the readable version is still there. This matches the convention already used elsewhere in the org (e.g.mikepenz/action-junit-report).Nothing else changed
Versions are pinned as they are today — no upgrades bundled in. Where a workflow sits on an old major (several repos are still on
actions/checkout@v2/setup-node@v2, which run on end-of-life runners), that deserves a separate upgrade PR rather than mixing a behaviour change into a security pin.Why now
The
sourcifyethorg is enabling Settings → Actions → General → Policies → "Require actions to be pinned to a full-length commit SHA". Once that's on, any workflow with an unpinned action fails. This should merge before that flip.Keeping pins fresh
Pinning without an updater means these SHAs go stale and stop picking up upstream security fixes. This repo has no Renovate config, so the pins are manual for now. Onboarding Renovate with
pinDigests: truewould keep them maintained — worth a follow-up.🤖 Generated with Claude Code