ci: pin all external GitHub Actions to commit SHAs (Sonar S7637) - #6019
Conversation
Resolves SonarCloud security hotspot S7637 (external GitHub Actions should be pinned to a commit hash) for actions/checkout. v4 -> 11d5960a326750d5838078e36cf38b85af677262
Resolves SonarCloud security hotspot S7637 for LouisBrunner/checks-action. Same SHA already used by the pinned call sites on v3.0. v2.0.0 -> 6b626ffbad7cc56fd58627f774b9067e6118af23
Resolves SonarCloud security hotspot S7637 for actions/upload-artifact. v4 -> ea165f8d65b6e75b540449e92b4886f43607fa02
Resolves SonarCloud security hotspot S7637 for actions/cache/restore. v4 -> 0057852bfaa89a56745cba8c7296529d2fc39830
Resolves SonarCloud security hotspot S7637 for actions/cache/save (same repo and tag as actions/cache/restore). v4 -> 0057852bfaa89a56745cba8c7296529d2fc39830
Resolves SonarCloud security hotspot S7637 for github/codeql-action (init and analyze). The autobuild reference is commented out and left as-is. v3 -> c4dd10e44af883a891fe31ced449bcb4a6728b9b
…it SHA Resolves SonarCloud security hotspot S7637 for the set-matrix-output/get-matrix-outputs composite actions. 0.14.0 -> d6367a8f0299d93cca9b42e287a56d2157f72060
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (67)
📜 Recent review details🔇 Additional comments (67)
📝 WalkthroughWalkthroughThe pull request pins GitHub Actions references to immutable commit SHAs across CI workflows. Existing inputs, conditions, artifact settings, checks, and workflow control flow remain unchanged. ChangesGitHub Actions pinning
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Review ✅ ApprovedPins all external GitHub Actions to verified commit SHAs with corresponding tag comments to satisfy Sonar rule S7637. No issues found. OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
1 participant
Companion to #6018 (v3.0 callers): resolves SonarCloud security hotspot rule S7637 ("External GitHub Actions and workflows should be pinned to a commit hash") for all external actions referenced by the reusable workflows on this branch.
Every external
uses:reference is now pinned to the full commit SHA with a trailing# <tag>comment. One commit per action:11d5960a326750d5838078e36cf38b85af6772626b626ffbad7cc56fd58627f774b9067e6118af23ea165f8d65b6e75b540449e92b4886f43607fa020057852bfaa89a56745cba8c7296529d2fc39830c4dd10e44af883a891fe31ced449bcb4a6728b9bd6367a8f0299d93cca9b42e287a56d2157f72060Each SHA was verified against the upstream repository (tag resolution + commit lookup via the GitHub API). The SHAs match the ones used in #6018 where the same action/tag is involved;
codecov/codecov-actionwas already pinned on this branch (cd6fee57b) and is untouched.Scope notes:
github/codeql-action/autobuild@v2line inci-codeql.ymlis left as-is.sysown/proxysql/.github/workflows/*.yml@...) are out of scope for S7637.Summary by CodeRabbit