From 8ab6824723be1ef36bebecc3416d658dd88db670 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 22:53:18 +0000 Subject: [PATCH] fix(ci): pin third-party actions to full commit SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows could not run at all. This resolves each ref to the commit it currently points at and records the ref in a trailing comment, e.g. `actions/checkout@ # v4`. `dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel. No behaviour is intended to change beyond the pins. --- .github/workflows/ada-ci.yml | 16 ++++++++-------- .github/workflows/dogfood-gate.yml | 12 ++++++------ .github/workflows/openssf-compliance.yml | 2 +- .github/workflows/static-analysis-gate.yml | 22 +++++++++++----------- .github/workflows/workflow-linter.yml | 2 +- 5 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/ada-ci.yml b/.github/workflows/ada-ci.yml index 1500814..33d30ca 100644 --- a/.github/workflows/ada-ci.yml +++ b/.github/workflows/ada-ci.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.4.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 submodules: recursive @@ -68,7 +68,7 @@ jobs: fi - name: Upload artifact - uses: actions/upload-artifact@v3.2.1 + uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1 with: name: trigger-binaries path: | @@ -85,10 +85,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.4.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Download artifact - uses: actions/download-artifact@v3.0.2 + uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 with: name: trigger-binaries path: . @@ -113,7 +113,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.4.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install Zig run: | @@ -131,7 +131,7 @@ jobs: ls -la ffi/zig/ - name: Upload Zig artifact - uses: actions/upload-artifact@v3.2.1 + uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1 with: name: zig-ffi path: ffi/zig/ @@ -145,7 +145,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.4.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Run self-diagnostics run: | @@ -192,7 +192,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.4.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Check for secrets run: | diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index da6679a..e17b7a9 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -30,7 +30,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Check for A2ML files id: detect @@ -75,7 +75,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Check for K9 files id: detect @@ -125,7 +125,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Scan for invisible characters id: lint @@ -190,7 +190,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Check for Groove manifest id: groove @@ -255,7 +255,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Check and validate eclexiaiser manifest id: eclex @@ -307,7 +307,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4.3.1 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Generate dogfooding scorecard run: | diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index 1b8bf80..a5d170a 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -21,7 +21,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4.3.1 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - name: Check SECURITY.md exists and has substance diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index f451114..6d83240 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -23,7 +23,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - name: Install panic-attack (if available) @@ -120,7 +120,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload panic-attack findings - uses: actions/upload-artifact@v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: panic-attack-findings path: panic-attack-findings.json @@ -147,13 +147,13 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - name: Setup Elixir for Hypatia scanner id: beam continue-on-error: true - uses: erlef/setup-beam@v1.20.4 + uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.20.4 with: elixir-version: '1.19.4' otp-version: '28.3' @@ -254,7 +254,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload hypatia findings - uses: actions/upload-artifact@v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: hypatia-findings path: hypatia-findings.json @@ -273,7 +273,7 @@ jobs: timeout-minutes: 15 steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - name: Install panic-attack (if available) @@ -335,7 +335,7 @@ jobs: echo "" >> "$GITHUB_STEP_SUMMARY" echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - name: Upload bridge report - uses: actions/upload-artifact@v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: bridge-report path: bridge-report.json @@ -357,17 +357,17 @@ jobs: if: always() steps: - name: Download panic-attack findings - uses: actions/download-artifact@v4.1.8 + uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 with: name: panic-attack-findings path: findings/ - name: Download hypatia findings - uses: actions/download-artifact@v4.1.8 + uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 with: name: hypatia-findings path: findings/ - name: Download bridge report - uses: actions/download-artifact@v4.1.8 + uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 with: name: bridge-report path: findings/ @@ -427,7 +427,7 @@ jobs: echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" echo "low=$LOW" >> "$GITHUB_OUTPUT" - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@v4.6.2 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: unified-findings path: findings/unified-findings.json diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 1505baa..8551e7f 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -28,7 +28,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Check SPDX Headers run: |