fix(ci): pin cpina/github-action-push-to-another-repository to a commit SHA - #1077
Open
nathanmelamed-cloudinary wants to merge 1 commit into
Open
fix(ci): pin cpina/github-action-push-to-another-repository to a commit SHA#1077nathanmelamed-cloudinary wants to merge 1 commit into
nathanmelamed-cloudinary wants to merge 1 commit into
Conversation
…it SHA The action was referenced as @main - a mutable branch. Anyone who gains control of that upstream repository can change what main points at, and the new code runs in this repository's CI on the next Playwright run, in a job where secrets.BOT_TOKEN is in scope. Nothing in this repository's protections covers that path: it needs no pull request, no review, and no workflow approval. Pinned to 55306faa4ed53b815ae49e564af8cfb359d32ae2 (main as of 2025-09-25). No behaviour change.
✅ Deploy Preview for cld-video-player ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for cld-vp-esm-pages ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pins
cpina/github-action-push-to-another-repositoryfrom@mainto commit55306faa4ed53b815ae49e564af8cfb359d32ae2(which is whatmainpoints at as of 2025-09-25).One line. No behaviour change.
Why this one specifically
@mainis a mutable branch. Whoever controls that upstream repository decides what runs in this repository's CI, and can change it at any time without any signal here.The step it runs in has
secrets.BOT_TOKENin scope:e2e_pr.ymlruns onpull_request, so this executes on ordinary development activity.What makes this different from the usual "pin your actions" advice: every other protection on this repository gates a person. Master requires a code-owner approval. External contributor workflow runs require approval (
approval_policy: all_external_contributors). Force pushes are blocked. None of that applies here — an upstream compromise needs no pull request, no review, and no run approval. It arrives on the next push to any branch.rtCamp/action-slack-notify@v2.2.0inrelease.ymlis the same class but lower risk: a tag rather than a branch, so it moves only if the maintainer retags. Worth pinning too — left out of this PR to keep it to one line and avoid a conflict with #1075, which already touchesrelease.yml.Verification
e2e_pr.ymlparses as valid YAMLmainin the upstream repository, so the action code being run is byte-identical to what runs today🤖 Generated with Claude Code