From 88a34178848acf24d7c9387814929a8791b4aa4f Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 09:38:08 +0000 Subject: [PATCH] Harden CI: pin the remaining first-party actions to commit SHAs Pins the last 30 unpinned `actions/*` references across 11 workflows to full commit SHAs, closing out the OpenSSF Scorecard PinnedDependencies work for every workflow not already covered by an open hardening PR. A floating tag such as `actions/checkout@v7` is a mutable pointer: whoever controls the tag controls what runs in CI. A commit SHA is immutable, so the workflow keeps running the reviewed code until someone deliberately bumps it. Every SHA was resolved from the tag the workflow already floats on, so this changes no action version: actions/checkout@v7 -> 3d3c42e5... # v7.0.1 actions/setup-python@v7 -> 5fda3b95... # v7.0.0 actions/setup-python@v6 -> ece7cb06... # v6.3.0 actions/setup-node@v7 -> 82076278... # v7.0.0 actions/upload-artifact@v7-> 043fb46d... # v7.0.1 actions/upload-artifact@v4-> ea165f8d... # v4.6.2 actions/cache@v6 -> 55cc8345... # v6.1.0 Files: api-latency-smoke, auto-deploy-cloud, e2e-nightly, moat-keystone-drive-nightly, openclaw-boot, oss-golden-path, overhead-bench, pr-screenshots, sync-test, windows-enterprise-tls, zero-click-auth-e2e. Diff is 30 insertions / 30 deletions, all on `uses:` lines. No `permissions:` block is touched, so the release/deploy workflows keep the scopes they have today. Co-Authored-By: Claude --- .github/workflows/api-latency-smoke.yml | 4 ++-- .github/workflows/auto-deploy-cloud.yml | 4 ++-- .github/workflows/e2e-nightly.yml | 4 ++-- .github/workflows/moat-keystone-drive-nightly.yml | 4 ++-- .github/workflows/openclaw-boot.yml | 4 ++-- .github/workflows/oss-golden-path.yml | 10 +++++----- .github/workflows/overhead-bench.yml | 6 +++--- .github/workflows/pr-screenshots.yml | 10 +++++----- .github/workflows/sync-test.yml | 4 ++-- .github/workflows/windows-enterprise-tls.yml | 4 ++-- .github/workflows/zero-click-auth-e2e.yml | 6 +++--- 11 files changed, 30 insertions(+), 30 deletions(-) diff --git a/.github/workflows/api-latency-smoke.yml b/.github/workflows/api-latency-smoke.yml index f978db4b9b..327756a753 100644 --- a/.github/workflows/api-latency-smoke.yml +++ b/.github/workflows/api-latency-smoke.yml @@ -38,8 +38,8 @@ jobs: OPENCLAW_GATEWAY_TOKEN: ci-smoke-token CLAWMETRY_LOCAL_STORE_PATH: ${{ github.workspace }}/.smoke/clawmetry.duckdb steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" diff --git a/.github/workflows/auto-deploy-cloud.yml b/.github/workflows/auto-deploy-cloud.yml index f402fea9fe..e19825364e 100644 --- a/.github/workflows/auto-deploy-cloud.yml +++ b/.github/workflows/auto-deploy-cloud.yml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout OSS repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Get OSS version id: oss_version @@ -80,7 +80,7 @@ jobs: echo "::warning::clawmetry==$V not on PyPI after wait; continuing (cloud CI will gate the merge)" - name: Checkout cloud repo - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: vivekchand/clawmetry-cloud token: ${{ secrets.CLOUD_REPO_PAT }} diff --git a/.github/workflows/e2e-nightly.yml b/.github/workflows/e2e-nightly.yml index 0e2d529cbe..384aed5ac0 100644 --- a/.github/workflows/e2e-nightly.yml +++ b/.github/workflows/e2e-nightly.yml @@ -31,8 +31,8 @@ jobs: continue-on-error: true steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" - name: Install dependencies diff --git a/.github/workflows/moat-keystone-drive-nightly.yml b/.github/workflows/moat-keystone-drive-nightly.yml index 6a4f27e45e..43a969528d 100644 --- a/.github/workflows/moat-keystone-drive-nightly.yml +++ b/.github/workflows/moat-keystone-drive-nightly.yml @@ -45,8 +45,8 @@ jobs: issues: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" cache: pip diff --git a/.github/workflows/openclaw-boot.yml b/.github/workflows/openclaw-boot.yml index 7f9c3ad282..3f11d02b7f 100644 --- a/.github/workflows/openclaw-boot.yml +++ b/.github/workflows/openclaw-boot.yml @@ -43,7 +43,7 @@ jobs: timeout-minutes: 5 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup OpenClaw id: openclaw @@ -136,7 +136,7 @@ jobs: - name: Upload gateway logs on failure if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: openclaw-gateway-logs path: /tmp/openclaw-logs/ diff --git a/.github/workflows/oss-golden-path.yml b/.github/workflows/oss-golden-path.yml index d0956936b7..d42caeccec 100644 --- a/.github/workflows/oss-golden-path.yml +++ b/.github/workflows/oss-golden-path.yml @@ -42,16 +42,16 @@ jobs: CLAWMETRY_HARD_BLOCK: '0' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" # Cache the ~100 MB Playwright chromium binary so the download step # takes seconds rather than minutes on warm runners. - name: Cache Playwright browsers - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/ms-playwright key: playwright-chromium-${{ runner.os }}-${{ hashFiles('setup.py', 'requirements.txt') }} @@ -300,7 +300,7 @@ jobs: - name: Upload JUnit test reports if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: junit-c1c5-${{ github.run_id }} path: /tmp/junit-*.xml @@ -309,7 +309,7 @@ jobs: - name: Upload logs on failure if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: c1-c5-golden-path-logs path: | diff --git a/.github/workflows/overhead-bench.yml b/.github/workflows/overhead-bench.yml index 0dc0d9c5a0..254ec06c9d 100644 --- a/.github/workflows/overhead-bench.yml +++ b/.github/workflows/overhead-bench.yml @@ -39,8 +39,8 @@ jobs: matrix: os: [ubuntu-latest, macos-latest, windows-latest] steps: - - uses: actions/checkout@v7 - - uses: actions/setup-python@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.11" @@ -102,7 +102,7 @@ jobs: for name, cond in hg["conditions"].items(): print(f" hook {name:<12} +{cond['added_over_floor_p50_us'] / 1000:.0f} ms over floor") - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: overhead-${{ matrix.os }} path: overhead-*.json diff --git a/.github/workflows/pr-screenshots.yml b/.github/workflows/pr-screenshots.yml index 404ca11751..ad3fbd92d3 100644 --- a/.github/workflows/pr-screenshots.yml +++ b/.github/workflows/pr-screenshots.yml @@ -67,24 +67,24 @@ jobs: steps: # -- 1. Check out PR head ------------------------------------------------ - name: Checkout PR head - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.sha }} path: head # -- 2. Check out PR base for "before" screenshots ---------------------- - name: Checkout PR base - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.base.sha }} path: base # -- 3. Toolchains ------------------------------------------------------- - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20" @@ -352,7 +352,7 @@ jobs: # -- 12. Belt + suspenders: upload PNGs as artefact ---------------------- - name: Upload screenshots artefact if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: visual-diff-pr-${{ github.event.pull_request.number }} path: screenshots/ diff --git a/.github/workflows/sync-test.yml b/.github/workflows/sync-test.yml index eec0d45c43..ac80c08ae3 100644 --- a/.github/workflows/sync-test.yml +++ b/.github/workflows/sync-test.yml @@ -37,9 +37,9 @@ jobs: name: Sync ${{ matrix.os }} / Python ${{ matrix.python }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python }} diff --git a/.github/workflows/windows-enterprise-tls.yml b/.github/workflows/windows-enterprise-tls.yml index ae2b5b9db0..a560734ded 100644 --- a/.github/workflows/windows-enterprise-tls.yml +++ b/.github/workflows/windows-enterprise-tls.yml @@ -32,9 +32,9 @@ jobs: runs-on: windows-latest timeout-minutes: 25 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: '3.13' diff --git a/.github/workflows/zero-click-auth-e2e.yml b/.github/workflows/zero-click-auth-e2e.yml index b56780c66d..879b56c2f2 100644 --- a/.github/workflows/zero-click-auth-e2e.yml +++ b/.github/workflows/zero-click-auth-e2e.yml @@ -44,13 +44,13 @@ jobs: CLAWMETRY_HARD_BLOCK: '0' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20"