From 7c7ba1da17ba48f257f2a2c7d810edbfc1bce284 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 08:38:35 +0000 Subject: [PATCH] Harden CI: pin the remaining third-party actions to commit SHAs Every action reference in this repository that is not owned by the `actions/` org still resolved through a mutable ref. Three of them pointed at a branch: browserstack/github-actions/setup-env@master browserstack/github-actions/setup-local@master (x2) peter-evans/create-pull-request@v8 (x2) github/codeql-action/upload-sarif@v3 A branch or floating tag is repointable by whoever controls the upstream repository, so the code these workflows execute can change with nothing landing here and nothing to review. This replaces each with the full commit SHA it resolves to today, plus a version comment. No action's version changes -- only how it is addressed. The four `actions/checkout` / `actions/setup-python` refs in the same files are pinned to the SHAs this repo already uses everywhere else, so one SHA per action holds across all 34 workflows. Verified: every file under .github/workflows/ re-parsed with yaml.safe_load; each changed file compared against HEAD as a parsed structure with `uses:` values masked, and the diff is empty; each new SHA fetched from its upstream repository to confirm it is a real commit. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LMbwMnwYkoSjZ62Zo7J9ec --- .github/workflows/browserstack.yml | 10 +++++----- .github/workflows/i18n-autotranslate.yml | 6 +++--- .github/workflows/i18n-docs-autotranslate.yml | 6 +++--- .github/workflows/supply-chain.yml | 2 +- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/browserstack.yml b/.github/workflows/browserstack.yml index 792c41ab2c..4f5ca625fa 100644 --- a/.github/workflows/browserstack.yml +++ b/.github/workflows/browserstack.yml @@ -20,9 +20,9 @@ jobs: timeout-minutes: 15 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" @@ -41,13 +41,13 @@ jobs: done - name: Set up BrowserStack env - uses: browserstack/github-actions/setup-env@master + uses: browserstack/github-actions/setup-env@1ab56d9521ce20f4651bb5d9f3ef39c5ba54805a # master @ 2026-08-28 with: username: ${{ secrets.BROWSERSTACK_USERNAME }} access-key: ${{ secrets.BROWSERSTACK_ACCESS_KEY }} - name: Start BrowserStack Local Tunnel - uses: browserstack/github-actions/setup-local@master + uses: browserstack/github-actions/setup-local@1ab56d9521ce20f4651bb5d9f3ef39c5ba54805a # master @ 2026-08-28 with: local-testing: start local-identifier: clawmetry-${{ github.run_id }} @@ -64,7 +64,7 @@ jobs: - name: Stop BrowserStack Local Tunnel if: always() - uses: browserstack/github-actions/setup-local@master + uses: browserstack/github-actions/setup-local@1ab56d9521ce20f4651bb5d9f3ef39c5ba54805a # master @ 2026-08-28 with: local-testing: stop local-identifier: clawmetry-${{ github.run_id }} diff --git a/.github/workflows/i18n-autotranslate.yml b/.github/workflows/i18n-autotranslate.yml index 7a40f20da5..7014e81242 100644 --- a/.github/workflows/i18n-autotranslate.yml +++ b/.github/workflows/i18n-autotranslate.yml @@ -31,7 +31,7 @@ jobs: # Claude Code subscription token (from `claude setup-token`), NOT an Anthropic API key. CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 # need the previous en.json to detect CHANGED keys @@ -42,7 +42,7 @@ jobs: echo "SKIP=1" >> "$GITHUB_ENV" fi - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 if: env.SKIP != '1' with: python-version: '3.11' @@ -68,7 +68,7 @@ jobs: - name: Open sync PR if: env.SKIP != '1' - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: branch: chore/i18n-autotranslate delete-branch: true diff --git a/.github/workflows/i18n-docs-autotranslate.yml b/.github/workflows/i18n-docs-autotranslate.yml index 430fb571fb..6283c60a3b 100644 --- a/.github/workflows/i18n-docs-autotranslate.yml +++ b/.github/workflows/i18n-docs-autotranslate.yml @@ -27,7 +27,7 @@ jobs: env: CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Guard - require Claude Code token run: | @@ -36,7 +36,7 @@ jobs: echo "SKIP=1" >> "$GITHUB_ENV" fi - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 if: env.SKIP != '1' with: python-version: '3.11' @@ -61,7 +61,7 @@ jobs: - name: Open sync PR if: env.SKIP != '1' - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: branch: chore/i18n-docs-autotranslate delete-branch: true diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 4ffd759813..351cce0040 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -157,6 +157,6 @@ jobs: path: scorecard-results.sarif retention-days: 30 # Surfaces findings in the GitHub Security tab rather than only in logs. - - uses: github/codeql-action/upload-sarif@v3 + - uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9 with: sarif_file: scorecard-results.sarif