Skip to content

chore: pin GitHub Actions to commit SHAs#2

Open
akandic47 wants to merge 2 commits intomainfrom
chore/update-gh-actions-2026-03-31
Open

chore: pin GitHub Actions to commit SHAs#2
akandic47 wants to merge 2 commits intomainfrom
chore/update-gh-actions-2026-03-31

Conversation

@akandic47
Copy link
Copy Markdown
Contributor

@akandic47 akandic47 commented Mar 31, 2026 •
edited
Loading

Summary

  • Pin all GitHub Action references to immutable commit SHAs instead of mutable tags
  • Prevents supply chain attacks via tag poisoning (e.g. Trivy-style attacks)
  • Version comments preserved inline for auditability
  • Actions updated to latest versions where applicable

Format

# Before (mutable tag):
uses: actions/checkout@v6.0.2
# After (immutable SHA):
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Test plan

  • Verify CI passes with SHA-pinned actions

@akandic47 akandic47 force-pushed the chore/update-gh-actions-2026-03-31 branch from 4114f5d to 7901857 Compare March 31, 2026 17:26
@akandic47 akandic47 force-pushed the chore/update-gh-actions-2026-03-31 branch from 7901857 to 7648b55 Compare March 31, 2026 17:44
@akandic47 akandic47 force-pushed the chore/update-gh-actions-2026-03-31 branch from 7648b55 to 4057316 Compare March 31, 2026 17:47
@akandic47
chore: pin GitHub Actions to commit SHAs
64c157e 
Pin all action references to immutable commit SHAs to prevent
supply chain attacks via tag poisoning. Version comments preserved
for auditability.
@akandic47 akandic47 changed the title chore: update GitHub Actions versions chore: pin GitHub Actions to commit SHAs Apr 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@akandic47