From e4d85f9588c861956982e0265e2a5348a180263c Mon Sep 17 00:00:00 2001 From: nathanmelamed-cloudinary <255658068+nathanmelamed-cloudinary@users.noreply.github.com> Date: Wed, 29 Jul 2026 14:29:55 +0300 Subject: [PATCH] fix(ci): pin cpina/github-action-push-to-another-repository to a commit SHA The action was referenced as @main - a mutable branch. Anyone who gains control of that upstream repository can change what main points at, and the new code runs in this repository's CI on the next Playwright run, in a job where secrets.BOT_TOKEN is in scope. Nothing in this repository's protections covers that path: it needs no pull request, no review, and no workflow approval. Pinned to 55306faa4ed53b815ae49e564af8cfb359d32ae2 (main as of 2025-09-25). No behaviour change. --- .github/workflows/e2e_pr.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/e2e_pr.yml b/.github/workflows/e2e_pr.yml index bdea9b3c..0d12bc5a 100644 --- a/.github/workflows/e2e_pr.yml +++ b/.github/workflows/e2e_pr.yml @@ -58,7 +58,7 @@ jobs: - name: Pushes to reports repository if: always() - uses: cpina/github-action-push-to-another-repository@main + uses: cpina/github-action-push-to-another-repository@55306faa4ed53b815ae49e564af8cfb359d32ae2 # main as of 2025-09-25 env: API_TOKEN_GITHUB: ${{ secrets.BOT_TOKEN }} with: