Pin github actions with ratchet

[averevki]

Summary

• Pin all GitHub Action references to commit SHAs using ratchet
• Add ratchet-pin and verify-ratchet Make targets for pinning and verifying action references
• Add verify-ratchet job to the existing CI workflow to block PRs with unpinned action references

Part of the work on Kuadrant/kuadrant-operator#2055

Motivation

Tags are mutable — action maintainers can force-push them, silently changing the code our CI runs. Pinning to commit SHAs makes each reference immutable, mitigating supply-chain attacks.

Summary by CodeRabbit

• Security & Reliability

  • Pinned workflow actions to immutable revisions, improving build and release reproducibility.
  • Added automated verification to detect unpinned workflow actions.

• Maintenance

  • Added tooling to pin and validate workflow action revisions.
  • Preserved existing build, test, chart, and release behaviour.

[coderabbitai]

📝 Walkthrough

Walkthrough

The workflows now pin GitHub Actions to immutable commit SHAs. The Makefile adds versioned Ratchet tooling and pinning commands. CI runs Ratchet verification and includes it in required checks.

Changes

GitHub Actions pinning

Layer / File(s)	Summary
Ratchet tooling and pin command Makefile	Adds versioned Ratchet installation, executable paths, and the ratchet-pin target.
Build and release workflow pinning .github/workflows/build-images-*.yaml, .github/workflows/delete-release-helm-chart.yaml, .github/workflows/issues-workflow.yaml, .github/workflows/release*.yaml	Pins workflow actions to commit SHAs. Release Helm workflow indentation is also normalised.
Ratchet CI enforcement .github/workflows/test.yaml, make/verify.mk	Pins test workflow actions, adds the verify-ratchet job, and includes it in required checks.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: eguzki

Poem

I’m a rabbit with commits in my paws,
I pin every action by immutable laws.
Ratchet checks hop through the CI queue,
Required checks guard what workflows do.
Carrots for builds—secure and true!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning GitHub Actions references with Ratchet.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pin-versions-with-ratchet

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test.yaml:
- Around line 212-226: Add a job-level permissions block to the verify-ratchet
job, granting only read access needed for checking out repository contents
(contents: read) and denying all other permissions by default. Keep the existing
checkout, Go setup, and make verify-ratchet steps unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c849aaa1-77cb-4e7b-bd7e-29a2e8734275

📥 Commits

Reviewing files that changed from the base of the PR and between 7cd841d and 46a9792.

📒 Files selected for processing (10)

• .github/workflows/build-images-base.yaml
• .github/workflows/build-images-for-tag-release.yaml
• .github/workflows/build-images-nightly.yaml
• .github/workflows/delete-release-helm-chart.yaml
• .github/workflows/issues-workflow.yaml
• .github/workflows/release-helm-chart.yaml
• .github/workflows/release.yaml
• .github/workflows/test.yaml
• Makefile
• make/verify.mk

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.51%. Comparing base (7cd841d) to head (46a9792).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #276      +/-   ##
==========================================
- Coverage   77.83%   76.51%   -1.32%     
==========================================
  Files          18       18              
  Lines        1137     1137              
==========================================
- Hits          885      870      -15     
- Misses        204      214      +10     
- Partials       48       53       +5     

Flag	Coverage Δ
integration	72.20% <ø> (-1.50%)	⬇️
unit	46.96% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
api/v1alpha1 (u)	91.48% <ø> (ø)
pkg/helpers (u)	80.95% <ø> (ø)
pkg/log (u)	94.73% <ø> (ø)
pkg/reconcilers (u)	64.53% <ø> (ø)
pkg/limitador (u)	98.28% <ø> (ø)
controllers (i)	71.75% <ø> (-4.33%)	⬇️
pkg/upgrades	∅ <ø> (∅)
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.