ci: pin github actions to sha and update to latest versions - #296
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
|
Deploy preview for express-basic-auth ready! ✅ Preview Built with commit da8ac5b. |
There was a problem hiding this comment.
Pull request overview
Pins all GitHub Actions used across this repository’s workflows to immutable commit SHAs (with version comments) to reduce supply-chain risk from mutable tags.
Changes:
- Replace
@v4action references with full commit SHAs across CI, deploy, and example workflows. - Add inline comments documenting the intended action release versions for the pinned SHAs.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/release-please.yml | Pins googleapis/release-please-action to a full SHA. |
| .github/workflows/example-static.yml | Pins actions/checkout to a full SHA. |
| .github/workflows/example-scope.yml | Pins actions/checkout to a full SHA. |
| .github/workflows/example-nextjs.yml | Pins actions/checkout, pnpm/action-setup, and actions/setup-node to full SHAs. |
| .github/workflows/example-express-basic-auth.yml | Pins actions/checkout to a full SHA. |
| .github/workflows/example-angular.yml | Pins actions/checkout, pnpm/action-setup, and actions/setup-node to full SHAs. |
| .github/workflows/deploy.yml | Pins actions/checkout to a full SHA. |
| .github/workflows/ci.yml | Pins actions/checkout, pnpm/action-setup, and actions/setup-node to full SHAs across jobs. |
| .github/workflows/check-dist.yml | Pins actions/checkout, pnpm/action-setup, actions/setup-node, and actions/upload-artifact to full SHAs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 9 files
Requires human review: Modifies CI/CD workflows, which is explicitly listed as a high-impact change requiring human review in the provided instructions.
Architecture diagram
sequenceDiagram
participant Dev as Developer
participant GH as GitHub Orchestrator
participant Runner as Action Runner (VM)
participant Registry as External Action Repos
participant Store as Artifact Storage
Note over GH,Registry: Supply Chain Security Hardening: SHA Pinning
Dev->>GH: Push Code / Open PR
GH->>Runner: Initialize Job (ci.yml / deploy.yml / etc.)
Runner->>Registry: CHANGED: Fetch actions/checkout (pinned to SHA)
Registry-->>Runner: v6.0.2 Source Code
Runner->>Runner: Checkout local repository
Runner->>Registry: CHANGED: Fetch pnpm/action-setup (pinned to SHA)
Registry-->>Runner: v5.0.0 Source Code
Runner->>Runner: Install pnpm environment
Runner->>Registry: CHANGED: Fetch actions/setup-node (pinned to SHA)
Registry-->>Runner: v6.3.0 Source Code
Runner->>Runner: Provision Node.js runtime
Note over Runner: Execute Build & Test Scripts
alt check-dist Job Failure
Runner->>Registry: CHANGED: Fetch actions/upload-artifact (pinned to SHA)
Registry-->>Runner: v7.0.0 Source Code
Runner->>Store: Upload distribution diff
end
Note over Runner,GH: Release Workflow (release-please.yml)
opt On Main Branch
Runner->>Registry: CHANGED: Fetch release-please-action (pinned to SHA)
Registry-->>Runner: v4.4.0 Source Code
Runner->>GH: Create Release PR / Update Changelog
end
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/dependabot.yml">
<violation number="1" location=".github/dependabot.yml:10">
P2: `"pnpm"` is not a valid Dependabot `package-ecosystem` value. Use `"npm"` instead — Dependabot's `npm` ecosystem automatically detects and handles `pnpm-lock.yaml` files. With the current value, Dependabot will silently ignore this entry and never create dependency update PRs for your pnpm packages.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
Deploy preview for team-scope-test ready! ✅ Preview Built with commit 93c4dd2. |
Pin all GitHub Actions to full commit SHAs with version comments for supply chain security: - actions/checkout: v4 → v6.0.2 - pnpm/action-setup: v4 → v5.0.0 - actions/setup-node: v4 → v6.3.0 - actions/upload-artifact: v4 → v7.0.0 - googleapis/release-please-action: v4 → v4.4.0
7209b1a to
93c4dd2
Compare
|
Summary
Pin all GitHub Actions to full commit SHAs with version comments for supply chain security. This prevents potential supply chain attacks where a mutable tag (e.g.,
v4) could be redirected to malicious code.Changes
actions/checkout:v4→de0fac2e4500dabe0009e67214ff5f5447ce83dd(v6.0.2)pnpm/action-setup:v4→fc06bc1257f339d1d5d8b3a19a8cae5388b55320(v5.0.0)actions/setup-node:v4→53b83947a5a98c8d113130e565377fae1a50d02f(v6.3.0)actions/upload-artifact:v4→bbbca2ddaa5d8feaa63e36b76fdaad77386f024f(v7.0.0)googleapis/release-please-action:v4→16a9c90856f42705d54a6fda1823352bdc62cf38(v4.4.0)Affected workflows:
check-dist.yml,ci.yml,deploy.yml,example-angular.yml,example-express-basic-auth.yml,example-nextjs.yml,example-scope.yml,example-static.yml,release-please.ymlTest Plan
Summary by cubic
Pinned all GitHub Actions to exact commit SHAs and upgraded to the latest versions to harden CI/CD. Added Dependabot to keep GitHub Actions and
pnpmdependencies up to date weekly.actions/checkout→ v6.0.2,pnpm/action-setup→ v5.0.0,actions/setup-node→ v6.3.0,actions/upload-artifact→ v7.0.0,googleapis/release-please-action→ v4.4.0.github/dependabot.ymlfor weekly updates to GitHub Actions andpnpm(commit prefixes:ci,chore)check-dist.yml,ci.yml,deploy.yml,release-please.yml, andexample-*.ymlWritten for commit da8ac5b. Summary will update on new commits.