From 37312bb6d7bfd9622bf6483201cc8c28f5500d08 Mon Sep 17 00:00:00 2001 From: Ahmed Abbas Date: Fri, 24 Jul 2026 19:27:32 +0300 Subject: [PATCH] chore(ci): SHA-pin third-party GitHub Actions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supply-chain hardening (Asana 1216667157595351): pin every third-party GitHub Action on a mutable tag/branch to a current-major commit SHA (no version bumps) — the tj-actions/changed-files (CVE-2025-30066) attack class. First-party actions/* are deferred to a later pass. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/codeql.yml | 2 +- .github/workflows/qa.yml | 6 +++--- .github/workflows/release.yml | 2 +- .github/workflows/split.yml | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 218e5e1..fa86044 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,7 +30,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.4' tools: composer:v2 diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml index d769a5c..86f65d7 100644 --- a/.github/workflows/qa.yml +++ b/.github/workflows/qa.yml @@ -57,7 +57,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.4' tools: composer:v2 @@ -76,7 +76,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.4' tools: composer:v2 @@ -104,7 +104,7 @@ jobs: dependency-preference: ['prefer-lowest', 'prefer-stable'] steps: - uses: actions/checkout@v4 - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: ${{ matrix.php-version }} tools: composer:v2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9126e1b..76fad6e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,7 @@ jobs: with: node-version: 'lts/*' - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.4' tools: composer:v2 diff --git a/.github/workflows/split.yml b/.github/workflows/split.yml index 79ed188..b2fc2da 100644 --- a/.github/workflows/split.yml +++ b/.github/workflows/split.yml @@ -31,7 +31,7 @@ jobs: fetch-depth: 0 - if: "!startsWith(github.ref, 'refs/tags/')" - uses: danharrin/monorepo-split-github-action@v2.4.4 + uses: danharrin/monorepo-split-github-action@f10477258c88013cc5902388ec47fe9457837041 # v2.4.4 with: package_directory: ${{ matrix.package.local_path }} repository_organization: 'convertcom' @@ -40,7 +40,7 @@ jobs: user_email: 'ci@convert.com' - if: "startsWith(github.ref, 'refs/tags/')" - uses: danharrin/monorepo-split-github-action@v2.4.4 + uses: danharrin/monorepo-split-github-action@f10477258c88013cc5902388ec47fe9457837041 # v2.4.4 with: tag: ${{ github.ref_name }} package_directory: ${{ matrix.package.local_path }}