Pin GitHub Actions to commit SHAs - #285
Open
tas50 wants to merge 1 commit into
Open
Conversation
Tags and branch refs are mutable pointers. Anyone who can push to an action's
repository can repoint `@v1` — or `@main` — at new code, and every workflow
referencing it picks that up on the next run with no change on our side. A
commit SHA cannot be repointed.
Three references here floated on a branch head rather than any version at all:
actionshub/dco@main
actionshub/get-pr-commits@main
fernandrone/linelint@master
Each pin keeps the version in a trailing `# vX.Y.Z` comment, which is what
Dependabot reads to bump it later. Pins stay inside the major version already
in use, so this is a conversion rather than an upgrade; the `@main` and
`@master` refs move to the latest tagged release, since an untagged commit
gives Dependabot nothing to track.
Also adds a dependabot.yml. There was none, so nothing would ever bump the new
SHA pins, and no bundler updates were being tracked either.
ci-main-pull-request-stub-1.0.7.yml is deliberately untouched. It references a
reusable workflow in chef/common-github-actions, not a third-party action, and
pinning it would cut this repo off from centrally-managed CI updates.
Signed-off-by: Tim Smith <tsmith84@proton.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every third-party action in this repo's workflows is referenced by a mutable pointer. This converts them all to immutable commit SHAs, with the version preserved in a trailing comment.
Why
A tag is a movable pointer. Anyone who can push to an action's repository can repoint
@v1at new code, and every workflow referencing it picks that up on the next run with no change on our side. A commit SHA can't be repointed.Three references here weren't even pinned to a version — they floated on a branch head, so every run picks up whatever happened to land on that branch:
Those two
actionshubactions gate DCO sign-off on every PR to this repo.The pins
actions/checkout@v6d23441a# v6.1.0ruby/setup-ruby@v195ef2b0# v1.321.0r7kamura/rubocop-problem-matchers-action@v159f1a07# v1.2.2streetsidesoftware/cspell-action@v8.4.0de2a73e# v8.4.0wechuli/allcheckspassed@v1e22f45a# v1.2.0actionshub/dco@main6246515# v2.0.0actionshub/get-pr-commits@main0f1d778# v2.0.0fernandrone/linelint@master7907a5d# 0.0.6This is a conversion, not an upgrade. Each pin resolves to the newest release within the major version already in use, so behavior is unchanged —
checkoutstays on v6 rather than jumping to v7, andcspell-actionstays on the exact v8.4.0 it already named rather than moving to v9. The@mainand@masterrefs are the one place a version genuinely changes, because there was no version to preserve; those resolve to the latest tagged release, since an untagged commit gives Dependabot nothing to track.Dependabot
SHA pins never move on their own, so pinning without automated bumping just trades a supply-chain risk for a staleness one. This repo had no
dependabot.ymlat all, so this adds one covering bothgithub-actionsandbundler— neither was being tracked. Dependabot reads the trailing# vX.Y.Zcomment to determine the current version and rewrites both the SHA and the comment on each bump.Left alone
ci-main-pull-request-stub-1.0.7.ymlreferenceschef/common-github-actions/.github/workflows/ci-main-pull-request.yml@main— a reusable workflow from an internal repo, not a third-party action. Pinning it would cut this repo off from centrally-managed CI updates, which is the opposite of what that stub is for.Verification
All four workflow files and the new
dependabot.ymlparse as valid YAML. Everyuses:reference outside the stub now resolves to a 40-character commit SHA — verified by grepping for any ref that isn't one, which returns nothing.Worth raising separately
This repo has no unit-test workflow.
lint.yml,dco.yml, andallchecks.ymlare the whole of CI; the stub setsunit-tests: false. The gemspec declaresrequired_ruby_version = ">= 3.1"andspec/is well populated withrake specwired up, but nothing runs it on any Ruby. That's a bigger change than pinning and I've deliberately kept it out of this PR — happy to open one adding a matrix over 3.1 through 4.0 if you want it.