ci: pin GitHub Actions to commit SHAs - #244
Conversation
Pin all third-party actions in the CI and release workflows to full commit SHAs (with version comments) instead of floating/mutable tags, following the pattern in cap-js/advanced-event-mesh#76.
SummaryThe following content is AI-generated and provides a summary of the pull request: Pin GitHub Actions to Full Commit SHAs for Supply-Chain SecurityChore🔒 Hardened CI and release workflows by pinning all third-party GitHub Actions references from mutable version tags to immutable full commit SHAs (with version comments for readability). This protects against supply-chain attacks where a mutable tag could be silently redirected to malicious code. Changes
Summary of pinned actions:
PR Bot InformationVersion:
|
![hyperspace-pr-bot[bot]](https://avatars.githubusercontent.com/u/2531208?s=60&v=4){kind=small}
There was a problem hiding this comment.
The PR correctly applies the supply-chain hardening practice of pinning GitHub Actions to full commit SHAs with version comments. However, the version comment annotations for actions/checkout (# v7.0.0) and actions/setup-node (# v6.4.0) appear incorrect — neither action has ever reached those major versions (both are on v4.x as of today). This is a significant concern: the whole value of SHA pinning depends on the comment accurately identifying which version the SHA corresponds to, so reviewers can audit and Dependabot update PRs can be evaluated meaningfully. The author should verify these SHAs against the upstream repositories and correct the version comments before merging.
PR Bot Information
Version: 1.29.2
- Event Trigger:
pull_request.opened - Experiment Variant:
control - Correlation ID:
de4909d0-899f-11f1-9067-004c6371431e - LLM:
anthropic--claude-4.6-sonnet - File Content Strategy: Full file content
2 participants
Pin all third-party GitHub Actions in the CI and release workflows to full commit SHAs (with version comments) instead of floating/mutable tags. This hardens the workflows against supply-chain risks from mutable tags.
Following the same approach as cap-js/advanced-event-mesh#76.
Changes
ci.yml
actions/checkout→9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0# v7.0.0actions/setup-node→48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e# v6.4.0release.yml
actions/checkout→9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0# v7.0.0actions/setup-node→48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e# v6.4.0martinbeentjes/npm-get-version-action→3cf273023a0dda27efcd3164bdfb51908dd46a5b# v1.3.1schwma/parse-changelog-action→1c2b2005ccf594cc3a45d33c10af4ab924d3a1c5# v1.2.0ncipollo/release-action@v1→339a81892b84b4eeb0f6e744e4574d79d0d9b8dd# v1.21.0