Skip to content

Commit e60ec04

Browse files
lexfreilexfrei
authored
ci(actions): pin third-party GitHub Actions to commit SHAs (#3227)
## What this PR does Pins the remaining floating version tags in the `build-main` and `ui-test` workflows to immutable commit SHAs, keeping the original tag in a trailing comment. This is a supply-chain hardening change: a mutable tag such as `@v4` can be force-repointed (by a compromised or malicious upstream) to arbitrary code, whereas a commit SHA is immutable. Most workflows in this repository were already SHA-pinned — this closes the last gap so that every third-party action is referenced by digest. Actions pinned in this PR: - `build-main.yaml`: `actions/checkout`, `docker/login-action`, `docker/setup-buildx-action` - `ui-test.yaml`: `actions/checkout`, `pnpm/action-setup`, `actions/setup-node` Each SHA is the exact commit the tag currently resolves to, so there is **no functional change**. The trailing `# vX` comment records the original tag; Renovate's `github-actions` manager understands this format and can keep the pins updated automatically. > Note: `.github/renovate.json` currently sets `enabledManagers: ["gomod"]`, so the `github-actions` manager is not active yet. For Renovate to auto-maintain these (and the other already-pinned) action digests, that manager needs to be enabled — suggested as a separate follow-up. ### Screenshots N/A — CI-only change, no user-facing or UI impact. ### Release note ```release-note NONE ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated CI workflows to use fixed, version-pinned action releases for build and UI test steps. * This helps make automated builds and tests more consistent and reliable over time. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 parents 63fcebd + 75452f3 commit e60ec04

2 files changed

Lines changed: 6 additions & 6 deletions

File tree

‎.github/workflows/build-main.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646

4747
steps:
4848
- name: Checkout code
49-
uses: actions/checkout@v4
49+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
5050
with:
5151
fetch-depth: 0
5252
fetch-tags: true
@@ -69,7 +69,7 @@ jobs:
6969
fi
7070
7171
- name: Login to OCIR
72-
uses: docker/login-action@v3
72+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
7373
with:
7474
username: ${{ secrets.OCIR_USER }}
7575
password: ${{ secrets.OCIR_TOKEN }}
@@ -82,7 +82,7 @@ jobs:
8282
# isolated buildkit so it never contends with PR builds on the shared one.
8383
- name: Set up Buildx (docker-container driver)
8484
id: buildx
85-
uses: docker/setup-buildx-action@v3
85+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
8686
with:
8787
driver: docker-container
8888
env:

‎.github/workflows/ui-test.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,17 +24,17 @@ jobs:
2424
runs-on: ubuntu-latest
2525
steps:
2626
- name: Checkout repository
27-
uses: actions/checkout@v4
27+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2828

2929
- name: Set up pnpm
30-
uses: pnpm/action-setup@v4
30+
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
3131
with:
3232
# The monorepo root has no package.json; read the pnpm version from
3333
# the console workspace manifest (packageManager field).
3434
package_json_file: packages/system/dashboard/images/console/package.json
3535

3636
- name: Set up Node.js
37-
uses: actions/setup-node@v4
37+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
3838
with:
3939
node-version: 22
4040
cache: pnpm

0 commit comments

Comments
 (0)