Repository navigation
ci: pin all tagged actions to commit SHAs and drop two release-workflow actions - #1338
Merged
Merged
Conversation
Contributor
|
Claude finished @mbevc1's task in 2m 0s —— View job Review of PR #1338: pin mutable action refs
Overall: This looks good. Each pin has a trailing version comment, and removing the two release actions is safe. Two follow-ups below. Looks good
Note: this PR only changes |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
mbevc1
marked this pull request as ready for review
November 5, 2026 23:02
mbevc1
changed the title
snyk/actions/setup@master, kosli-dev/reusable-actions@main and anchore/sbom-action@v0 resolve to whatever the branch or floating tag points at when the job starts, and they run next to SNYK_TOKEN, Slack webhooks and the release job's contents/id-token/attestations write permissions. The release job's goreleaser-action and setup-node were also on floating major tags. Each ref is pinned to the commit it resolves to today, so behaviour is unchanged: snyk setup/ is identical between v1.0.0 and master, and anchore's v0 tag points at v0.24.0. The version comments let Dependabot keep the tagged pins current. reusable-actions has no tags, so its pin carries the branch name instead.
dawidd6/action-get-tag only read the tag name from GITHUB_REF; a run step now does the same from GITHUB_REF_NAME and keeps the step id, so every steps.tag.outputs.tag reference is unchanged. It also fails on a non-tag ref, as the action did. dcarbone/install-jq-action installed jq, which ubuntu-latest runner images already ship. It ran in the goreleaser job, which holds contents, id-token and attestations write permissions.
These ran on floating major tags in jobs that hold write tokens and secrets, including the goreleaser job with contents and id-token write, GORELEASER_KEY and FURY_TOKEN. Every use is pinned, so the same action is not mixed pinned and floating across workflows. Each pin is the commit its major tag points at today (checkout v7.0.1, setup-go v7.0.0, setup-cli-action v5.2.4), so behaviour is unchanged.
reusable-actions has no version tags, and Dependabot only moves a SHA pin when the action's repository has at least one tag, so the pin would go stale. It is our own repository, so following main keeps fixes flowing to every workflow without a manual bump.
The rest of the third-party and first-party actions still resolved their tag at job start. Most run next to secrets or write tokens: AWS OIDC credentials, registry pushes, attestations, the codecov token, the GitHub App token in the Helm workflow, and the cross-repo PATs that peter-evans/repository-dispatch receives in the release workflow. Each pin is the commit its tag points at today, labelled with the most specific version tag at that commit, so behaviour is unchanged and Dependabot can keep the pins current. kosli-dev/reusable-actions is the only action left on a branch, as its repository has no tags.
mbevc1
force-pushed
the
20261105_chore_gha_pinning
branch
from
November 5, 2026 23:11
7ee5ae9 to
cdab328
Compare
mbevc1
enabled auto-merge (squash)
November 5, 2026 23:12
mbevc1
force-pushed
the
20261105_chore_gha_pinning
branch
from
November 5, 2026 23:37
a3eda55 to
cdab328
Compare
AlexKantor87
approved these changes
Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin every action that has version tags to the commit its current ref resolves to, so no workflow picks up a moved tag or branch next to secrets or write tokens.
kosli-dev/reusable-actionsstays on@mainbecause it has no tags for Dependabot to follow. Also dropdawidd6/action-get-taganddcarbone/install-jq-actionfrom the release workflow, since a run step and the runner's own jq do the same job.Checklist
charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR