ci: pin third-party GitHub Actions to commit SHAs#63
Merged
Conversation
Pin actions/checkout, actions/cache, erlef/setup-beam, actions/upload-artifact, actions/download-artifact in release.yml to full commit SHAs (with version comments) for supply-chain hardening. Add .github/dependabot.yml to keep the pinned actions updated weekly. Follow-up to smkwlab/.github#69. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JPuooHgsrboSEbfJsNf6iG
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| - name: Download all build artifacts | ||
| uses: actions/download-artifact@v4 | ||
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 |
Contributor
There was a problem hiding this comment.
ℹ️ [LOW] 他のアクションはピンにパッチバージョンまで(例: v4.3.1, v4.6.2)がコメントに記載されていますが、download-artifact のみ # v4 とメジャーバージョンのみになっています。将来 Dependabot が更新した際の追跡容易性のため、他と揃えて具体的なタグ(例: v4.x.x)をコメントに記載することを推奨します。
Member
Author
There was a problem hiding this comment.
ご指摘ありがとうございます。この # v4 は、smkwlab/.github#69 のエコシステム横断ピン作業で全リポジトリに適用している固定 SHA→タグ対応表に由来しており、意図的にメジャーバージョン表記としています（他リポの download-artifact の同一 SHA d3f86a1 も揃えて # v4）。他アクションの粒度差はこの共通マッピングの粒度をそのまま反映したものです。追跡容易性は Dependabot（本 PR で追加）が SHA 更新時にコメントも書き換えるため担保されます。エコシステム全体の一貫性を優先し、このリビジョンでは据え置きます。
| @@ -0,0 +1,12 @@ | |||
| version: 2 | |||
| updates: | |||
| # Keep SHA-pinned third-party GitHub Actions up to date (Renovate here is | |||
Contributor
There was a problem hiding this comment.
✨ [POSITIVE] Dependabot による GitHub Actions の SHA ピン自動更新の設定は適切です。Renovate が mix のみを扱うという役割分担がコメントで明示されており、保守担当者にとって意図が分かりやすくなっています。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pin third-party GitHub Actions in
.github/workflows/release.ymlto full commit SHAs (with version comments) for supply-chain hardening, and add.github/dependabot.ymlto keep the pinned actions up to date.Follow-up to smkwlab/.github#69 (items 2/3/5).
Pins applied (release.yml)
Notes
smkwlab/.github/.github/workflows/*.yml@v1refs (elixir.yml, security.yml, ai-code-review.yml) are intentionally left on@v1— that is the org's shared-CI channel..github/dependabot.ymladded because Renovate in this repo is mix-only and does not manage GitHub Actions; Dependabot now updates the SHA-pinned actions weekly (grouped).actionlint(clean) and YAML parse.🤖 Generated with Claude Code