Skip to content

[Aikido] AI Fix for 3rd party Github Actions should be pinned - #185

Merged
ash-bluepollution95 merged 1 commit into
mainfrom
fix/aikido-security-sast-22647889-frmg
Apr 10, 2026
Merged

[Aikido] AI Fix for 3rd party Github Actions should be pinned#185
ash-bluepollution95 merged 1 commit into
mainfrom
fix/aikido-security-sast-22647889-frmg

Conversation

@aikido-autofix

Copy link
Copy Markdown
Contributor

This patch mitigates a potential supply chain attack by pinning the version of third-party Github Actions to their commit SHA.

Aikido used AI to generate this PR.

High confidence: Aikido has a robust set of benchmarks for similar fixes, and they are proven to be effective.

Related Tasks:

@aikido-autofix aikido-autofix Bot added the Dependencies Fix Label created by Aikido AutoFix label Apr 10, 2026
@github-actions

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 0cf1e57.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

.github/workflows/claude.yml

PackageVersionLicenseIssue Type
anthropics/claude-code-action28f83620103c48a57093dcc2837eec89e036bb9fNullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
actions/anthropics/claude-code-action 28f83620103c48a57093dcc2837eec89e036bb9f UnknownUnknown

Scanned Files

  • .github/workflows/claude.yml

@what-the-diff

what-the-diff Bot commented Apr 10, 2026

Copy link
Copy Markdown

PR Summary

  • 🚀 Updated Version of claude-code-action Tool
    We've retired the beta version of claude-code-action and upgraded to a specific, more stable version (28f83620103c48a57093dcc2837eec89e036bb9f). This will ensure smoother functioning and prevent potential issues caused by being on a beta version. 🎉👨‍💻👩‍💻

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

THANKS! Onto it, will check it asap!

@ash-bluepollution95
ash-bluepollution95 marked this pull request as ready for review April 10, 2026 11:43
@ash-bluepollution95
ash-bluepollution95 merged commit d785237 into main Apr 10, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Dependencies Fix Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant