From c172049abedb3614884c84ec9f337018c1fe510a Mon Sep 17 00:00:00 2001 From: Rei Date: Fri, 26 Jun 2026 11:45:12 +0200 Subject: [PATCH] chore(security): pin external GitHub Actions to commit SHAs Pin external third-party actions to full-length commit SHAs with a trailing version comment to mitigate mutable-tag supply-chain attacks. Internal SecureAuthCorp/* references intentionally left on floating tags. No functional change: each SHA resolves to the commit the existing tag points to. DEVOPS-8397 --- .github/workflows/build.yaml | 4 ++-- .github/workflows/lint.yaml | 6 +++--- .github/workflows/release.yaml | 6 +++--- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 6ebf9e4..5a6cb8f 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -6,9 +6,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: '1.26' cache: true diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index bad3c58..9ef7462 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -15,12 +15,12 @@ jobs: golangci: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: '1.26' cache: true - name: golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9 with: version: v2.11 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6220028..39b49c2 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -12,15 +12,15 @@ jobs: goreleaser: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: fetch-depth: 0 - run: git fetch --force --tags - - uses: actions/setup-go@v6 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: '1.26' cache: true - - uses: goreleaser/goreleaser-action@v7 + - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7 with: distribution: goreleaser version: latest