ci: pin all GitHub Actions to commit SHAs#436
Conversation
Supply-chain hardening ahead of the public-repo flip. Every external
action across all 8 workflows is now pinned to a full-length commit SHA
with the human-readable version in a trailing comment. The local
composite action (./.github/actions/setup-security-attestation-tools)
is exempt.
This is the prerequisite for enabling the repo's "require actions to be
pinned to a SHA" policy, which will be turned on once this merges so a
moving tag can't be used to swap action code out from under CI.
Pinned: actions/{checkout,setup-node,setup-python,cache,upload-artifact,
download-artifact,github-script,attest-build-provenance},
pnpm/action-setup, oven-sh/setup-bun, anchore/scan-action,
neondatabase/create-branch-action.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAll GitHub Actions ChangesGitHub Actions version pinning
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
agent-paste PR preview is ready. API: https://agent-paste-api-pr-436.isaac-a46.workers.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy-preview.yml:
- Line 39: The workflow pins the wrong commit SHAs for some actions: update the
checkout pin currently set as
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 to the correct SHA for
the v6.0.3 tag (9f698171ed81b15d1823a05fc7211befd50c8ae0), and update
pnpm/action-setup which is pinned to 0e279bb959325dab635dd2c09392533439d90093 to
the correct SHA for v6.0.8 (d15e628ca66d93ee5f352c71671a7bc6a97af5c9); leave
actions/setup-node@v6.4.0 (48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e) as-is.
Ensure the action strings actions/checkout@v6.0.3 and pnpm/action-setup@v6.0.8
are paired with their matching commit SHAs in the workflow.
In @.github/workflows/pr-preview-cleanup.yml:
- Line 46: The workflow references neondatabase/create-branch-action@v6.4.0 but
the pinned SHA fb620d43d4c565abaf088b848a4e28e5c4ea4d9c does not resolve to that
tag; update the action reference in the workflow to a valid tag or commit SHA by
verifying the correct tag for neondatabase/create-branch-action (replace
neondatabase/create-branch-action@v6.4.0 with the correct `@tag` or the exact
commit SHA), or adjust the pinned SHA to match the actual git ref so the tag
verification passes; ensure any other action pins (e.g., actions/checkout,
pnpm/action-setup, actions/setup-node, actions/github-script) remain unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5a61ff63-16ab-4ddf-a9b6-0ba8e405e4dd
📒 Files selected for processing (8)
.github/workflows/ci.yml.github/workflows/cli-advertise.yml.github/workflows/cli-release.yml.github/workflows/deploy-preview.yml.github/workflows/deploy-production.yml.github/workflows/pr-preview-cleanup.yml.github/workflows/pr-preview.yml.github/workflows/security.yml
The `v6` major tag this action was pinned from points to the 6.3.1 release commit (also GitHub's "latest release"), not v6.4.0. The SHA is unchanged (identical to what @v6 resolved to before pinning); only the trailing version comment is corrected for accuracy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
agent-paste PR preview is ready. API: https://agent-paste-api-pr-436.isaac-a46.workers.dev |
|
agent-paste PR preview resources were cleaned up. The shared Preview GitHub Environment is retained for future preview deploys. |
1 participant
Summary
Supply-chain hardening ahead of the public-repo flip. Every external action across all 8 workflows is now pinned to a full-length commit SHA, with the human-readable version kept in a trailing comment. The local composite action (
./.github/actions/setup-security-attestation-tools) is exempt, as are local paths.This is the prerequisite for turning on the repo's "require actions to be pinned to a SHA" policy (
sha_pinning_required), which will be enabled once this merges so a moving tag can't swap action code out from under CI.Changes
Pinned to SHA (12 actions):
actions/checkoutactions/setup-nodeactions/setup-pythonactions/cacheactions/upload-artifactactions/download-artifactactions/github-scriptactions/attest-build-provenancepnpm/action-setupoven-sh/setup-bunanchore/scan-actionneondatabase/create-branch-actionDiff is a 1:1 line swap (51 insertions / 51 deletions) — only the ref on each
uses:line changed; no structural workflow edits.Risk
Low. Each SHA was resolved live from the major tag it was already tracking, so behavior is unchanged at merge time. Trade-off: future updates require bumping the pinned SHA (the scheduled dependency-update agent / Dependabot can do this and keep the version comment in sync).
Test plan
Validategreen (parses + runs all workflows on this PR)sha_pinning_requiredand confirm a tag-pinneduses:is rejected🤖 Generated with Claude Code
Summary by CodeRabbit