From 795a241645b877cfebb03dd78130fb4f9548751c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 28 Aug 2026 03:37:10 +0000
Subject: [PATCH] Harden CI: pin supply-chain.yml actions to commit SHAs

A floating tag resolves at run time, so whoever controls the tag controls
what runs in CI. Pin the 13 resolvable action references in
supply-chain.yml to full commit SHAs, keeping the human-readable version
in a trailing comment so Dependabot can still propose bumps.

Digests are the same ones already validated by the ci.yml pinning branch:
  actions/checkout       v7.0.1
  actions/setup-python   v7.0.0
  actions/upload-artifact v7.0.1

github/codeql-action/upload-sarif is deliberately left on its tag: an open
Dependabot PR is bumping codeql-action from 3 to 4, and pinning it here
would conflict with that bump.

Only `uses:` values change -- the parsed YAML is otherwise identical, and
no permissions block is touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LHL2XjNoJMscqDHfYNmVWs
---
 .github/workflows/supply-chain.yml | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 1038375956..4ffd759813 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -32,8 +32,8 @@ jobs:
     name: No third-party asset loads
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Scan served pages for absolute http(s) asset references
@@ -43,8 +43,8 @@ jobs:
     name: Vendored assets match npm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Verify sha256 pins and byte-compare against the npm registry
@@ -54,8 +54,8 @@ jobs:
     name: Vendored fonts not stale
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       # requests is needed because tests/conftest.py imports it at module
@@ -79,8 +79,8 @@ jobs:
     name: Python dependency audit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - run: python3 -m pip install --quiet pip-audit cyclonedx-bom
@@ -95,7 +95,7 @@ jobs:
           python3 -m pip install --quiet -r requirements.txt
           cyclonedx-py environment --output-format JSON > clawmetry-sbom.json
       - name: Publish SBOM as a build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: clawmetry-sbom
           path: clawmetry-sbom.json
@@ -105,8 +105,8 @@ jobs:
     name: Action references resolve
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       # An unresolvable action fails its job at "Set up job" before any step
@@ -132,7 +132,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # Pinned to the v2.4.4 commit, not a floating tag. Two reasons:
@@ -151,7 +151,7 @@ jobs:
           # Publishes to the public OpenSSF API so the README badge resolves.
           # Results are already public for a public repo.
           publish_results: true
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: scorecard-results
           path: scorecard-results.sarif