Raised by CodeRabbit (zizmor unpinned-uses) on #101 and deferred there as out of scope — that PR is boot-failure diagnostics and did not introduce the unpinned references.
What
actions/cache@v5, actions/upload-artifact@v6, actions/checkout@v5 and friends are mutable tag references. A tag can be re-pointed at different code, so a compromised or simply retagged upstream release runs with whatever permissions the job has.
The convention already exists in this repo — oven-sh/setup-bun is pinned:
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # setup-bun action v2.2.0
It just was never extended to the first-party actions/* uses.
Scope
Repo-wide, not one file — integration.yml, ci.yml, lab.yml, release.yml, sweep.yml and lint-powershell.yml all use mutable tags. Pinning only the six usages in integration.yml (as the review suggested) would leave the policy half-applied and imply a guarantee that does not hold.
Suggested shape
- Pin every
uses: to a full commit SHA with the version in a trailing comment, matching the setup-bun style.
- Add a Dependabot
github-actions ecosystem entry so the pins get PRs instead of rotting — pinning without automated bumps trades a supply-chain risk for a staleness one.
- Consider
zizmor in CI to keep it enforced, since that is what surfaced it.
Low urgency, entirely mechanical, and a good standalone task.
Raised by CodeRabbit (zizmor
unpinned-uses) on #101 and deferred there as out of scope — that PR is boot-failure diagnostics and did not introduce the unpinned references.What
actions/cache@v5,actions/upload-artifact@v6,actions/checkout@v5and friends are mutable tag references. A tag can be re-pointed at different code, so a compromised or simply retagged upstream release runs with whatever permissions the job has.The convention already exists in this repo —
oven-sh/setup-bunis pinned:It just was never extended to the first-party
actions/*uses.Scope
Repo-wide, not one file —
integration.yml,ci.yml,lab.yml,release.yml,sweep.ymlandlint-powershell.ymlall use mutable tags. Pinning only the six usages inintegration.yml(as the review suggested) would leave the policy half-applied and imply a guarantee that does not hold.Suggested shape
uses:to a full commit SHA with the version in a trailing comment, matching thesetup-bunstyle.github-actionsecosystem entry so the pins get PRs instead of rotting — pinning without automated bumps trades a supply-chain risk for a staleness one.zizmorin CI to keep it enforced, since that is what surfaced it.Low urgency, entirely mechanical, and a good standalone task.