Skip to content

chore: pin GitHub Actions to commit SHAs#222

Merged
akandic47 merged 2 commits intomainfrom
chore/update-gh-actions-2026-03-31
Apr 13, 2026
Merged

chore: pin GitHub Actions to commit SHAs#222
akandic47 merged 2 commits intomainfrom
chore/update-gh-actions-2026-03-31

Conversation

@akandic47
Copy link
Copy Markdown
Contributor

@akandic47 akandic47 commented Mar 31, 2026

Summary

  • Pin all GitHub Action references to immutable commit SHAs instead of mutable tags
  • Prevents supply chain attacks via tag poisoning (e.g. Trivy-style attacks)
  • Version comments preserved inline for auditability
  • Actions updated to latest versions where applicable

Format

# Before (mutable tag):
uses: actions/checkout@v6.0.2
# After (immutable SHA):
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Test plan

  • Verify CI passes with SHA-pinned actions

@akandic47 akandic47 force-pushed the chore/update-gh-actions-2026-03-31 branch 2 times, most recently from 6acfb41 to bec118d Compare March 31, 2026 17:44
@akandic47 akandic47 force-pushed the chore/update-gh-actions-2026-03-31 branch from bec118d to c7cf68e Compare March 31, 2026 17:47
Pin all action references to immutable commit SHAs to prevent
supply chain attacks via tag poisoning. Version comments preserved
for auditability.
@akandic47 akandic47 changed the title chore: update GitHub Actions chore: pin GitHub Actions to commit SHAs Apr 9, 2026
@akandic47 akandic47 merged commit 2b7d242 into main Apr 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants