Harden CI: pin the remaining first-party actions to commit SHAs - #5294
Merged
Conversation
Pins the last 30 unpinned `actions/*` references across 11 workflows to full commit SHAs, closing out the OpenSSF Scorecard PinnedDependencies work for every workflow not already covered by an open hardening PR. A floating tag such as `actions/checkout@v7` is a mutable pointer: whoever controls the tag controls what runs in CI. A commit SHA is immutable, so the workflow keeps running the reviewed code until someone deliberately bumps it. Every SHA was resolved from the tag the workflow already floats on, so this changes no action version: actions/checkout@v7 -> 3d3c42e5... # v7.0.1 actions/setup-python@v7 -> 5fda3b95... # v7.0.0 actions/setup-python@v6 -> ece7cb06... # v6.3.0 actions/setup-node@v7 -> 82076278... # v7.0.0 actions/upload-artifact@v7-> 043fb46d... # v7.0.1 actions/upload-artifact@v4-> ea165f8d... # v4.6.2 actions/cache@v6 -> 55cc8345... # v6.1.0 Files: api-latency-smoke, auto-deploy-cloud, e2e-nightly, moat-keystone-drive-nightly, openclaw-boot, oss-golden-path, overhead-bench, pr-screenshots, sync-test, windows-enterprise-tls, zero-click-auth-e2e. Diff is 30 insertions / 30 deletions, all on `uses:` lines. No `permissions:` block is touched, so the release/deploy workflows keep the scopes they have today. Co-Authored-By: Claude <noreply@anthropic.com>
✅ Drift Bot (ClawMetry): no drift detectedDrift Bot analyzed the changed files against this project's blueprints and requirements and found no drift. |
Contributor
Visual diffComparing 37 of 66 comparison(s) flagged (>1% pixel diff).
Folder: 88a34178848a. Full PNGs also attached as a workflow artefact. Generated by visual-diff bot. Pixel diffs >1% flagged; eyeball the table before merging. This check is non-blocking — fail = bot bug, not a code problem. |
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pins the last 30 unpinned
actions/*references across 11 workflows to full commit SHAs. This closes out the OpenSSF Scorecard PinnedDependencies work for every workflow that is not already covered by an open hardening PR.A floating tag like
actions/checkout@v7is a mutable pointer — whoever controls the tag controls what runs in CI. A commit SHA is immutable, so the workflow keeps running the reviewed code until someone deliberately bumps it.No version changes
Every SHA was resolved from the tag the workflow already floats on, so nothing is upgraded or downgraded:
actions/checkout@v73d3c42e5aac5ba805825da76410c181273ba90b1actions/setup-python@v75fda3b95a4ea91299a34e894583c3862153e4b97actions/setup-python@v6ece7cb06caefa5fff74198d8649806c4678c61a1actions/setup-node@v7820762786026740c76f36085b0efc47a31fe5020actions/upload-artifact@v7043fb46d1a93c77aae656e7c1c64a875d1fc6a0aactions/upload-artifact@v4ea165f8d65b6e75b540449e92b4886f43607fa02actions/cache@v655cc8345863c7cc4c66a329aec7e433d2d1c52a9Five of these seven SHAs are already pinned elsewhere in this repo, so the values are consistent with what has already been reviewed and merged.
Files
api-latency-smoke,auto-deploy-cloud,e2e-nightly,moat-keystone-drive-nightly,openclaw-boot,oss-golden-path,overhead-bench,pr-screenshots,sync-test,windows-enterprise-tls,zero-click-auth-e2e.Scope / safety
uses:line. Verified mechanically.permissions:block is touched.auto-deploy-cloudandmoat-keystone-drive-nightlyneed write scopes and keep exactly the scopes they have today — this PR is pinning only, one concern.yaml.safe_loadafter the edit.python3 scripts/check_action_refs.pypasses.Coordination
No overlap with the two open hardening PRs. #5283 and #5285 claim 13 workflow files between them; this PR takes the 11 they do not touch. Once all three land, every
uses:reference in.github/workflows/is SHA-pinned..github/is exempt from the product-record gate, so no Factory record is cited.Generated by Claude Code