Repository navigation
[Feature Request] Pin remaining release workflow actions to commit SHAs #1211
Description
Description
Following #704, the release workflow still uses mutable tags such as actions/checkout@v7, oven-sh/setup-bun@v2, and docker/build-push-action@v7.
Motivation
Compromised upstream tags could introduce malicious code into the publishing job. SHA pinning reduces this supply-chain risk and makes action updates reviewable.
Proposed Solution
Pin the remaining actions to full commit SHAs.
Alternatives
No response
Additional Information
Astral’s security post explains the approach. Related: dmno-dev/bumpy#162.
Activity
pullfrog commentedon Oct 12, 2026
[-]Pin remaining release workflow actions to commit SHAs[/-][+][Feature Request] Pin remaining release workflow actions to commit SHAs[/+]theoephraim commentedon Oct 14, 2026
My rationale here is that I have only left actions unpinned that belong to very large trusted orgs (github, bun, docker) where I have very high confidence that they will not be compromised. Maybe that's expecting too much...
mikkelal commentedon Oct 15, 2026
Thanks for sorting this in #1229! I’m keeping bumpy#162 open to track the same changes there.