Pin GitHub Actions to commit SHAs and update to latest - #44
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Supply-chain hardening for this repo’s GitHub Actions by pinning third-party actions to immutable commit SHAs (with human-readable version comments) and aligning the UI deploy wrangler version with the Workers apps.
Changes:
- Pin
actions/checkoutusages in all workflows to a full commit SHA for v7.0.1. - Pin the local composite setup action’s dependencies (
pnpm/action-setupv6.0.9 andactions/setup-nodev7.0.0) to full commit SHAs. - Update UI deploy to use
pnpm dlx wrangler@4.107.0.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/migrations.yml | Pins actions/checkout to an immutable SHA for the migrations workflow. |
| .github/workflows/main.yml | Pins actions/checkout across main CI/deploy jobs and updates the UI deploy wrangler version. |
| .github/workflows/feature.yml | Pins actions/checkout across feature-branch CI jobs. |
| .github/actions/setup/action.yml | Pins pnpm/action-setup and actions/setup-node to immutable SHAs in the shared composite setup action. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Supply-chain hardening — pin every third-party GitHub Action to a full commit SHA (mutable tags can be re-pointed by a hijacked action) and update each to its latest release:
actions/checkoutv5 → v7.0.1 (3d3c42e…) — 15 refs across feature/main/migrationsactions/setup-nodev6 → v7.0.0 (8207627…)pnpm/action-setupv4 → v6.0.9 (0ebf471…) — also clears the Node 20 deprecation warning (v4 ran on node20)pnpm dlx wrangler@4.66.0→4.107.0(aligns with the api/jobs workers)Each ref carries a
# vX.Y.Zcomment for readability. The local./.github/actions/setupcomposite is unchanged (local path, not a supply-chain surface).Why safe
No workflow uses
pull_request_target/workflow_run, so checkout v7's fork-PR change doesn't apply. setup-node v7 is ESM/dep-only; pnpm v6 still readspackageManager: pnpm@10.28.1.pnpm format:checkpasses; all pinned SHAs verified to resolve to their tags.How to test
CI itself is the test: this PR's
feature.ymlrun exercises the pinned checkout + composite (pnpm/setup-node) across typecheck/lint/test/format. Green CI + no Node 20 warning = success. Deploy jobs (incl. wrangler 4.107.0) validate on merge to main.🤖 Generated with Claude Code