fix: pin GitHub Actions to commit SHAs - #492
Open
PrekshithD-Microsoft wants to merge 1 commit into
Open
Conversation
|
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request hardens the repository’s CI/CD supply chain by replacing GitHub Actions version tags in workflow uses: entries with immutable commit SHA pins across .github/workflows/.
Changes:
- Updated third-party GitHub Actions references (e.g.,
actions/checkout,actions/setup-python,azure/login, Docker actions, etc.) from moving tags to pinned commit SHAs. - Kept human-readable version context via inline comments (e.g.,
# v6,# v7) next to each SHA. - Applied the updates consistently across validation, test, deployment, Docker, maintenance, and policy-check workflows.
Reviewed changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/validate-bicep-params.yml | Pins checkout/setup-python/upload-artifact actions to SHAs for deterministic validation runs. |
| .github/workflows/test.yml | Pins checkout/setup-python actions to SHAs to stabilize test workflow dependencies. |
| .github/workflows/test-automation.yml | Pins checkout/setup-python/azure-login/upload-artifact actions to SHAs for automated test runs. |
| .github/workflows/test-automation-v2.yml | Pins checkout/setup-python/azure-login/upload-artifact actions to SHAs for the v2 automation pipeline. |
| .github/workflows/telemetry-template-check.yml | Pins checkout action to a SHA for consistent telemetry template checks. |
| .github/workflows/stale-bot.yml | Pins stale/checkout/upload-artifact actions to SHAs for predictable maintenance automation. |
| .github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml | Pins checkout action to a SHA for stable scheduled automations. |
| .github/workflows/pylint.yml | Pins checkout/setup-python actions to SHAs for consistent lint tooling setup. |
| .github/workflows/pr-title-checker.yml | Pins semantic PR action to a SHA for deterministic PR title enforcement. |
| .github/workflows/job-docker-build.yml | Pins checkout/buildx/azure-login/build-push actions to SHAs for reproducible Docker builds. |
| .github/workflows/job-deploy.yml | Pins checkout/azure-login actions to SHAs for reliable deployment jobs. |
| .github/workflows/job-deploy-windows.yml | Pins checkout/setup-azd/azure-login actions to SHAs for Windows deployment consistency. |
| .github/workflows/job-deploy-linux.yml | Pins checkout/setup-azd/azure-login actions to SHAs for Linux deployment consistency. |
| .github/workflows/job-cleanup-deployment.yml | Pins azure-login action to a SHA for deterministic cleanup execution. |
| .github/workflows/deploy.yml | Pins checkout/azure-login actions to SHAs for consistent end-to-end deploy workflow runs. |
| .github/workflows/build-docker.yml | Pins checkout/azure-login/buildx/build-push actions to SHAs for stable Docker build workflow. |
| .github/workflows/broken-links-checker.yml | Pins checkout and lychee action to SHAs for deterministic link checking. |
| .github/workflows/azure-dev.yml | Pins checkout/setup-azd/azure-login actions to SHAs for stable Azure dev workflow runs. |
| .github/workflows/azd-template-validation.yml | Pins checkout and template-validation action to SHAs for deterministic template validation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates all GitHub Actions in the repository's workflow files to use explicit commit SHA references instead of version tags. This change improves the security and stability of the CI/CD pipeline by ensuring that workflows use immutable, reviewed versions of third-party actions.
The most important changes include:
Security and Stability Improvements:
uses:references for third-party GitHub Actions (such asactions/checkout,azure/login,actions/setup-python,docker/build-push-action, etc.) across all workflow YAML files in.github/workflows/have been updated from version tags (e.g.,@v6,@v3,@v7) to specific commit SHAs, ensuring that the exact version of each action is used and cannot change unexpectedly. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33]Workflow Consistency:
No functional changes to workflow logic or steps were made—only the method of referencing action versions was changed for improved supply chain security.## Purpose
Does this introduce a breaking change?
Golden Path Validation
Deployment Validation
What to Check
Verify that the following are valid
Other Information