Skip to content

Commit 8ab6824

Browse files
hyperpolymathhyperpolymath
committed
fix(ci): pin third-party actions to full commit SHAs
The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows could not run at all. This resolves each ref to the commit it currently points at and records the ref in a trailing comment, e.g. `actions/checkout@<sha> # v4`. `dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel. No behaviour is intended to change beyond the pins.
1 parent 0095817 commit 8ab6824

5 files changed

Lines changed: 27 additions & 27 deletions

File tree

‎.github/workflows/ada-ci.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535

3636
steps:
3737
- name: Checkout repository
38-
uses: actions/checkout@v4.4.0
38+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
3939
with:
4040
fetch-depth: 0
4141
submodules: recursive
@@ -68,7 +68,7 @@ jobs:
6868
fi
6969
7070
- name: Upload artifact
71-
uses: actions/upload-artifact@v3.2.1
71+
uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
7272
with:
7373
name: trigger-binaries
7474
path: |
@@ -85,10 +85,10 @@ jobs:
8585

8686
steps:
8787
- name: Checkout repository
88-
uses: actions/checkout@v4.4.0
88+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
8989

9090
- name: Download artifact
91-
uses: actions/download-artifact@v3.0.2
91+
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
9292
with:
9393
name: trigger-binaries
9494
path: .
@@ -113,7 +113,7 @@ jobs:
113113

114114
steps:
115115
- name: Checkout repository
116-
uses: actions/checkout@v4.4.0
116+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
117117

118118
- name: Install Zig
119119
run: |
@@ -131,7 +131,7 @@ jobs:
131131
ls -la ffi/zig/
132132
133133
- name: Upload Zig artifact
134-
uses: actions/upload-artifact@v3.2.1
134+
uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
135135
with:
136136
name: zig-ffi
137137
path: ffi/zig/
@@ -145,7 +145,7 @@ jobs:
145145

146146
steps:
147147
- name: Checkout repository
148-
uses: actions/checkout@v4.4.0
148+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
149149

150150
- name: Run self-diagnostics
151151
run: |
@@ -192,7 +192,7 @@ jobs:
192192

193193
steps:
194194
- name: Checkout repository
195-
uses: actions/checkout@v4.4.0
195+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
196196

197197
- name: Check for secrets
198198
run: |

‎.github/workflows/dogfood-gate.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030

3131
steps:
3232
- name: Checkout repository
33-
uses: actions/checkout@v4.3.1
33+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3434

3535
- name: Check for A2ML files
3636
id: detect
@@ -75,7 +75,7 @@ jobs:
7575

7676
steps:
7777
- name: Checkout repository
78-
uses: actions/checkout@v4.3.1
78+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
7979

8080
- name: Check for K9 files
8181
id: detect
@@ -125,7 +125,7 @@ jobs:
125125

126126
steps:
127127
- name: Checkout repository
128-
uses: actions/checkout@v4.3.1
128+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
129129

130130
- name: Scan for invisible characters
131131
id: lint
@@ -190,7 +190,7 @@ jobs:
190190

191191
steps:
192192
- name: Checkout repository
193-
uses: actions/checkout@v4.3.1
193+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
194194

195195
- name: Check for Groove manifest
196196
id: groove
@@ -255,7 +255,7 @@ jobs:
255255

256256
steps:
257257
- name: Checkout repository
258-
uses: actions/checkout@v4.3.1
258+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
259259

260260
- name: Check and validate eclexiaiser manifest
261261
id: eclex
@@ -307,7 +307,7 @@ jobs:
307307

308308
steps:
309309
- name: Checkout repository
310-
uses: actions/checkout@v4.3.1
310+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
311311

312312
- name: Generate dogfooding scorecard
313313
run: |

‎.github/workflows/openssf-compliance.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
permissions:
2222
contents: read
2323
steps:
24-
- uses: actions/checkout@v4.3.1
24+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2525
with:
2626
persist-credentials: false
2727
- name: Check SECURITY.md exists and has substance

‎.github/workflows/static-analysis-gate.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
timeout-minutes: 15
2424
steps:
2525
- name: Checkout repository
26-
uses: actions/checkout@v6.0.2
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2727
with:
2828
fetch-depth: 0
2929
- name: Install panic-attack (if available)
@@ -120,7 +120,7 @@ jobs:
120120
echo "" >> "$GITHUB_STEP_SUMMARY"
121121
echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY"
122122
- name: Upload panic-attack findings
123-
uses: actions/upload-artifact@v4.6.2
123+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
124124
with:
125125
name: panic-attack-findings
126126
path: panic-attack-findings.json
@@ -147,13 +147,13 @@ jobs:
147147
timeout-minutes: 15
148148
steps:
149149
- name: Checkout repository
150-
uses: actions/checkout@v6.0.2
150+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
151151
with:
152152
fetch-depth: 0
153153
- name: Setup Elixir for Hypatia scanner
154154
id: beam
155155
continue-on-error: true
156-
uses: erlef/setup-beam@v1.20.4
156+
uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.20.4
157157
with:
158158
elixir-version: '1.19.4'
159159
otp-version: '28.3'
@@ -254,7 +254,7 @@ jobs:
254254
echo "" >> "$GITHUB_STEP_SUMMARY"
255255
echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY"
256256
- name: Upload hypatia findings
257-
uses: actions/upload-artifact@v4.6.2
257+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
258258
with:
259259
name: hypatia-findings
260260
path: hypatia-findings.json
@@ -273,7 +273,7 @@ jobs:
273273
timeout-minutes: 15
274274
steps:
275275
- name: Checkout repository
276-
uses: actions/checkout@v6.0.2
276+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
277277
with:
278278
fetch-depth: 0
279279
- name: Install panic-attack (if available)
@@ -335,7 +335,7 @@ jobs:
335335
echo "" >> "$GITHUB_STEP_SUMMARY"
336336
echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY"
337337
- name: Upload bridge report
338-
uses: actions/upload-artifact@v4.6.2
338+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
339339
with:
340340
name: bridge-report
341341
path: bridge-report.json
@@ -357,17 +357,17 @@ jobs:
357357
if: always()
358358
steps:
359359
- name: Download panic-attack findings
360-
uses: actions/download-artifact@v4.1.8
360+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
361361
with:
362362
name: panic-attack-findings
363363
path: findings/
364364
- name: Download hypatia findings
365-
uses: actions/download-artifact@v4.1.8
365+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
366366
with:
367367
name: hypatia-findings
368368
path: findings/
369369
- name: Download bridge report
370-
uses: actions/download-artifact@v4.1.8
370+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
371371
with:
372372
name: bridge-report
373373
path: findings/
@@ -427,7 +427,7 @@ jobs:
427427
echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT"
428428
echo "low=$LOW" >> "$GITHUB_OUTPUT"
429429
- name: Upload unified findings (fleet scanner picks these up)
430-
uses: actions/upload-artifact@v4.6.2
430+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
431431
with:
432432
name: unified-findings
433433
path: findings/unified-findings.json

‎.github/workflows/workflow-linter.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828

2929
steps:
3030
- name: Checkout
31-
uses: actions/checkout@v6.0.2
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3232

3333
- name: Check SPDX Headers
3434
run: |

0 commit comments

Comments
 (0)