From bcf3077267208ad2d67188c3a4d7d66cc06fea66 Mon Sep 17 00:00:00 2001 From: John Kennedy <65985482+jkennedyvz@users.noreply.github.com> Date: Wed, 25 Mar 2026 10:58:38 -0700 Subject: [PATCH] ci: SHA-pin all third-party GitHub Actions (#7277) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - SHA-pins 7 distinct third-party actions across 10 workflow files to full commit SHAs - Prevents supply chain attacks via tag hijacking (mutable tags can be force-pushed by a compromised maintainer account) - Tag retained as an inline comment for readability | Action | Before | After | |--------|--------|-------| | `dorny/paths-filter` | `@v4` | `@fbd0ab8...` | | `Ana06/get-changed-files` | `@v2.3.0` | `@25f79e6...` | | `docker/login-action` | `@v4` | `@b45d80f...` | | `pypa/gh-action-pypi-publish` | `@release/v1` | `@ed0c539...` | | `ncipollo/release-action` | `@v1` | `@339a818...` | | `amannn/action-semantic-pull-request` | `@v6` | `@48f2562...` | | `peter-evans/create-pull-request` | `@v8` | `@c0f553f...` | ## Test plan - [x] CI passes on this PR - [x] Verify each pinned action still functions (no behaviour change, only ref format) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- .github/workflows/_integration_test.yml | 2 +- .github/workflows/_lint.yml | 2 +- .github/workflows/_test.yml | 2 +- .github/workflows/_test_langgraph.yml | 2 +- .github/workflows/_test_release.yml | 2 +- .github/workflows/bench.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/pr_lint.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/uv_lock_ugprade.yml | 2 +- 10 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/_integration_test.yml b/.github/workflows/_integration_test.yml index 1099274c9..f51e4dcf1 100644 --- a/.github/workflows/_integration_test.yml +++ b/.github/workflows/_integration_test.yml @@ -41,7 +41,7 @@ jobs: - name: Get changed files id: changed-files if: github.event_name != 'workflow_dispatch' - uses: Ana06/get-changed-files@v2.3.0 + uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c # v2.3.0 with: filter: "libs/cli/**" - name: Set up Python ${{ matrix.python-version }} diff --git a/.github/workflows/_lint.yml b/.github/workflows/_lint.yml index 65d56632f..a46c6dd0a 100644 --- a/.github/workflows/_lint.yml +++ b/.github/workflows/_lint.yml @@ -35,7 +35,7 @@ jobs: - name: Get changed files id: changed-files if: github.event_name != 'workflow_dispatch' - uses: Ana06/get-changed-files@v2.3.0 + uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c # v2.3.0 with: filter: "${{ inputs.working-directory }}/**" - name: Set up Python ${{ matrix.python-version }} diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml index c3f3d852e..f6f4b5829 100644 --- a/.github/workflows/_test.yml +++ b/.github/workflows/_test.yml @@ -33,7 +33,7 @@ jobs: cache-suffix: test-${{ inputs.working-directory }} working-directory: ${{ inputs.working-directory }} - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4 if: ${{ !github.event.pull_request.head.repo.fork }} with: username: ${{ secrets.DOCKERHUB_USERNAME }} diff --git a/.github/workflows/_test_langgraph.yml b/.github/workflows/_test_langgraph.yml index 21c24ef79..9715f3bfe 100644 --- a/.github/workflows/_test_langgraph.yml +++ b/.github/workflows/_test_langgraph.yml @@ -31,7 +31,7 @@ jobs: cache-suffix: "test-langgraph" working-directory: libs/langgraph - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4 if: ${{ !github.event.pull_request.head.repo.fork }} with: username: ${{ secrets.DOCKERHUB_USERNAME }} diff --git a/.github/workflows/_test_release.yml b/.github/workflows/_test_release.yml index 1d656ef63..a95e1dfe8 100644 --- a/.github/workflows/_test_release.yml +++ b/.github/workflows/_test_release.yml @@ -82,7 +82,7 @@ jobs: path: ${{ inputs.working-directory }}/dist/ - name: Publish to test PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1 with: packages-dir: ${{ inputs.working-directory }}/dist/ verbose: true diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml index 8f70cc1c7..03dd22a8f 100644 --- a/.github/workflows/bench.yml +++ b/.github/workflows/bench.yml @@ -18,7 +18,7 @@ jobs: - uses: actions/checkout@v6 - id: files name: Get changed files - uses: Ana06/get-changed-files@v2.3.0 + uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c # v2.3.0 with: format: json - name: Set up Python 3.11 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 57a94bb8a..1b2643494 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,7 +30,7 @@ jobs: deps: ${{ steps.filter.outputs.deps || 'true' }} steps: - uses: actions/checkout@v6 - - uses: dorny/paths-filter@v4 + - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4 if: github.event_name != 'workflow_dispatch' id: filter with: diff --git a/.github/workflows/pr_lint.yml b/.github/workflows/pr_lint.yml index 944f51e59..bfc22ae3a 100644 --- a/.github/workflows/pr_lint.yml +++ b/.github/workflows/pr_lint.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Validate PR Title - uses: amannn/action-semantic-pull-request@v6 + uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 052200a22..96e982ae5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -276,7 +276,7 @@ jobs: path: ${{ inputs.working-directory }}/dist/ - name: Publish package distributions to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1 with: packages-dir: ${{ inputs.working-directory }}/dist/ verbose: true @@ -317,7 +317,7 @@ jobs: path: ${{ inputs.working-directory }}/dist/ - name: Create Tag - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 with: artifacts: "dist/*" token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/uv_lock_ugprade.yml b/.github/workflows/uv_lock_ugprade.yml index c1bf0e1f9..eaf374cc5 100644 --- a/.github/workflows/uv_lock_ugprade.yml +++ b/.github/workflows/uv_lock_ugprade.yml @@ -28,7 +28,7 @@ jobs: run: make lock-upgrade - name: Create Pull Request - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8 with: token: ${{ secrets.GITHUB_TOKEN }} commit-message: "chore(deps): upgrade dependencies with `uv lock --upgrade`"