Skip to content

[Security hardening] Pin GitHub Actions by SHA#2441

Open
PascalThuet wants to merge 1 commit intogithub:mainfrom
PascalThuet:codex/pin-github-actions
Open

[Security hardening] Pin GitHub Actions by SHA#2441
PascalThuet wants to merge 1 commit intogithub:mainfrom
PascalThuet:codex/pin-github-actions

Conversation

@PascalThuet
Copy link
Copy Markdown
Contributor

Summary

  • Pin GitHub Actions workflow dependencies to immutable commit SHAs.
  • Keep the upstream tag version as a trailing comment for maintainability.

Security context

This reduces supply-chain risk from mutable action tags.

Closes #2439

Validation

  • git diff --check
  • rg -n "uses: [^@]+@v[0-9]" .github/workflows

@PascalThuet PascalThuet marked this pull request as ready for review May 2, 2026 06:40
@PascalThuet PascalThuet requested a review from mnriem as a code owner May 2, 2026 06:40
@PascalThuet PascalThuet marked this pull request as draft May 2, 2026 06:44
@PascalThuet PascalThuet marked this pull request as ready for review May 2, 2026 06:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security hardening] Pin remaining GitHub Actions to immutable commit SHAs

1 participant