Repository navigation
Pin all GitHub Actions to commit SHAs - #1229
Merged
Merged
Conversation
Contributor
📦 Bundle sizeno change to bundle size
dist/ only; native binaries are versioned separately and not counted here. |
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
No new issues found.
Reviewed changes: Reviewed all workflow and Dependabot changes, verified upstream release-tag SHAs, and checked upgrade compatibility with existing inputs and consumers.
- Action pins: Replaces mutable action references with full commit SHAs and version comments across CI, release, signing, and automation workflows.
- Version upgrades: Updates action majors and standardizes artifact/comment actions; preserves Rust stable-toolchain selection through an explicit input.
- Update automation: Adds weekly grouped Dependabot updates with a seven-day cooldown and labels Dependabot PRs as
bot.
Release-only Azure authentication and native cache restores were reviewed statically, not executed; native build and smoke-test jobs were skipped in this PR's CI.
gpt-6.1-sol ｜ 𝕏
theoephraim
added a commit
that referenced
this pull request
Oct 19, 2026
* Pin remaining GitHub Actions to commit SHAs and enforce it in CI #1226 branched before #1229 and reintroduced tag refs in the macOS binary build plus two download-artifact steps. Pin those, and add a CI check that fails on any remote action not pinned to a full SHA with a ref comment. * Drop custom pin check in favor of GitHub's require-SHA-pinning setting
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins every third-party action in
.github/workflowsto a full commit SHA with a version comment, instead of mutable tags. A moved tag (as in the tj-actions/changed-files and reviewdog compromises) can no longer change what runs in CI or release jobs..github/dependabot.ymlfor thegithub-actionsecosystem: weekly, grouped into one PR, with a 7-day cooldown before adopting new releasesdtolnay/rust-toolchainwas on thestablebranch; now pinned to amastercommit withtoolchain: stablepassed explicitlycachev6,setup-nodev7,labelerv7,azure/loginv3 (Node 24),pnpm/action-setupv6.1.0, and unifies stragglers (upload-artifact/download-artifactv4,github-scriptv7,cachev4,checkoutv6) onto the versions used elsewherepr-labelernow labelsdependabot[bot]PRs asbotRelease-only paths (
azure/loginv3, cache restores inrelease.yaml) aren't exercised by PR CI and will first run on the next release.Follow-up: enable the repo setting that requires actions to be pinned to a full-length SHA.