chore(ISV-7504): pin CI actions to SHA hash

[bclindner]

Signed-off-by: Brian Lindner blindner@redhat.com

[qodo-redhat-openshift-ecosystem]

PR Summary by Qodo

Pin GitHub Actions in CI/CD workflow to commit SHAs

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Pin all GitHub Actions used in CI/CD to immutable commit SHAs.
• Add version comments to keep action intent readable while hardening supply-chain security.
• Apply pins consistently across build, image, and deploy jobs.

Diagram

graph TD
  W["CI/CD workflow"] --> C["actions/checkout (SHA)"] --> PN["pnpm/action-setup (SHA)"] --> N["actions/setup-node (SHA)"] --> PO["snok/install-poetry (SHA)"]
  W --> L["podman-login (SHA)"]
  W --> A["ansible-playbook (SHA)"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Keep using version tags (e.g., @v4) without SHA pinning

• ➕ Automatic receipt of upstream bug/security fixes
• ➕ Less maintenance overhead updating SHAs
• ➖ Weaker supply-chain guarantees (tag can move / compromised release)
• ➖ Harder to audit exactly what ran in historical CI

2. Automate pinning/updates with tooling (e.g., pinact + Dependabot)

• ➕ Retains immutable SHAs while reducing manual update work
• ➕ Creates reviewable PRs when upstream action versions change
• ➖ Adds an additional tool/workflow to maintain
• ➖ May increase PR churn if not tuned

Recommendation: Pinning actions to SHAs (as done here) is the best default for CI supply-chain hardening, and the added version comments preserve readability. If maintenance burden becomes noticeable, consider layering automation (pinning updater + Dependabot) to keep SHAs current via routine PRs.

Files changed (1) +11 / -11

Other (1) +11 / -11

ci-cd.yamlPin CI/CD GitHub Actions to commit SHAs +11/-11

Pin CI/CD GitHub Actions to commit SHAs

• Replaces floating action tags (e.g., @v4/@v1.4.1) with specific commit SHAs across all jobs. Adds inline comments indicating the intended action versions to keep the workflow readable while ensuring immutability.

.github/workflows/ci-cd.yaml

[qodo-redhat-openshift-ecosystem]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[bclindner]

@JakubDurkac FYI pnpm had to be pinned in the containerfile to get the build running again - hope that's okay

[JakubDurkac]

Seems good to me. Before merging, I would suggest adding "deploy-stage" label to this PR. That should trigger deployment to stage. Just to see if deployment goes fine as it's been some time since the last one. In pipeline-metrics repo for example, there seems to be an outdated token for deployment at the moment.