Skip to content

chore: pin GitHub Actions uses: references to commit SHA instead of tag#731

Merged
credfeto merged 2 commits into
mainfrom
chore/728-pin-actions-sha
Jul 23, 2026
Merged

chore: pin GitHub Actions uses: references to commit SHA instead of tag#731
credfeto merged 2 commits into
mainfrom
chore/728-pin-actions-sha

Conversation

@dnyw4l3n13

@dnyw4l3n13 dnyw4l3n13 commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Part of an org-wide audit of .github/workflows/*.yml and .github/actions/*/action.yml files for GitHub Actions referenced by a mutable tag instead of a full commit SHA. A tag can be repointed by the upstream maintainer, or an attacker who compromises their account, without warning; a commit SHA is immutable.

This PR will pin the four uses: references in .github/workflows/geoipupdate.yml to their immutable commit SHAs, keeping the released version as a trailing comment:

  • actions/checkout@v7.0.1 -> actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
  • actions/setup-dotnet@v6 -> actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
  • credfeto/action-dotnet-version-detect@v1.3.0 -> credfeto/action-dotnet-version-detect@d572bbd7285038bda731c8a4f237b9b8e64a9954 # v1.3.0
  • stefanzweifel/git-auto-commit-action@v7 -> stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7

All four SHAs have been independently verified against the upstream repositories' tags (git ls-remote --tags) and match exactly.

Test strategy

  • actionlint / repo YAML lint against the edited workflow.
  • Verify each SHA resolves to the stated tag upstream (done above).

Closes #728

@dnyw4l3n13
chore(#728): add placeholder changelog entry for Actions SHA pinning
1179ad5 
Scaffolding commit ahead of pinning the geoipupdate.yml uses: references
to immutable commit SHAs.

Prompt: Work on issue #728 in credfeto/scripts.
@dnyw4l3n13 dnyw4l3n13 self-assigned this Jul 23, 2026
@dnyw4l3n13 dnyw4l3n13 added the auto-pr Pull request created automatically label Jul 23, 2026
@dnyw4l3n13 dnyw4l3n13 changed the title chore(#728): add placeholder changelog entry for Actions SHA pinning chore: pin GitHub Actions uses: references to commit SHA instead of tag Jul 23, 2026
@dnyw4l3n13 dnyw4l3n13 mentioned this pull request Jul 23, 2026
Closed
@dnyw4l3n13 dnyw4l3n13 added AI-Work Work for an AI Agent Security Security issue, e.g. use of insecure packages, or security fix labels Jul 23, 2026
@dnyw4l3n13
chore(#728): pin GitHub Actions uses: references to commit SHA in geo…
b4dbdcd 
…ipupdate.yml

Pins actions/checkout, credfeto/action-dotnet-version-detect,
actions/setup-dotnet, and stefanzweifel/git-auto-commit-action to their
immutable commit SHAs (with the released tag as a trailing comment) so a
compromised or repointed upstream tag cannot silently change what runs.
@dnyw4l3n13

dnyw4l3n13 commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator Author

Fixed in b4dbdcd - pinned the four uses: references in .github/workflows/geoipupdate.yml to their commit SHAs (with tag as trailing comment), completing the work described in this PR/issue #728 that was missing from the branch. Board moved to Development; CI will run next.

@dnyw4l3n13

dnyw4l3n13 commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator Author

Simplify clean - advancing to code review

@dnyw4l3n13

dnyw4l3n13 commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator Author

Code Review: Pin GitHub Actions in geoipupdate.yml

Summary

Low blast-radius change: pins 4 uses: references in .github/workflows/geoipupdate.yml to commit SHAs with version comments, plus a matching CHANGELOG entry. Verified each SHA against its upstream tag via the GitHub API - all four resolve correctly (actions/checkout@3d3c42e5a... = v7.0.1, credfeto/action-dotnet-version-detect@d572bbd7... = v1.3.0, actions/setup-dotnet@a98b5685... = v6, stefanzweifel/git-auto-commit-action@4a55954c... = v7). Formatting matches the SHA-pinning convention already used elsewhere in this repo's workflows.

Critical (must fix before merge)

None.

Warnings (should fix, creates tech debt)

None.

Suggestions (nice to have)

None.

Architecture Compliance

PASS - no workflow logic changed, only version pinning.

Test Coverage

N/A - CI/CD metadata change, no testable logic. Existing CI (build-pre-release, pull-request) passes.

What's Good

No findings. Advancing to security review.

@dnyw4l3n13

dnyw4l3n13 commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator Author

Code review clean - advancing to security review

@dnyw4l3n13

dnyw4l3n13 commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator Author

Security review clean, advancing to coverage check

@dnyw4l3n13

dnyw4l3n13 commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator Author

AI Coverage phase: blocked - no baseline captured

The AI Coverage phase decision procedure requires a ## Coverage Baseline (main) comment on this PR to compare branch coverage against, but none exists (checked both top-level comments and reviews - none match).

This baseline should have been captured and posted during the Pre-Work Baseline Check on main before this branch/PR was created (see coverage-ratchet.instructions.md). Its absence is a gap from an earlier phase, not something this phase can self-heal by capturing a baseline now - re-baselining via checkout-swap is reserved for the post-rebase case, not for an initial capture that was simply never done.

To unblock: a human (or an earlier-phase rerun) needs to capture main's per-language coverage baseline and post it as a ## Coverage Baseline (main) comment on this PR, after which the AI Coverage phase can be re-run.

@dnyw4l3n13 dnyw4l3n13 added the Blocked Blocked by a dependency or external factor label Jul 23, 2026
@credfeto

credfeto commented Jul 23, 2026

Copy link
Copy Markdown
Owner

no need for coverage of github acction changes

@credfeto credfeto removed the Blocked Blocked by a dependency or external factor label Jul 23, 2026
@credfeto
credfeto marked this pull request as ready for review July 23, 2026 13:40
Copilot AI review requested due to automatic review settings July 23, 2026 13:40
Copilot AI reviewed Jul 23, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@credfeto
credfeto enabled auto-merge July 23, 2026 13:40
@credfeto

credfeto commented Jul 23, 2026

Copy link
Copy Markdown
Owner

Super-linter summary

Language Validation result
GITHUB_ACTIONS Pass ✅
YAML Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

@credfeto
credfeto merged commit a0630b5 into main Jul 23, 2026
40 checks passed
@credfeto
credfeto deleted the chore/728-pin-actions-sha branch July 23, 2026 13:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@credfeto credfeto credfeto approved these changes

Assignees

@dnyw4l3n13 dnyw4l3n13

Labels

AI-Work Work for an AI Agent auto-pr Pull request created automatically Security Security issue, e.g. use of insecure packages, or security fix

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

chore: pin GitHub Actions uses: references to commit SHA instead of tag

3 participants

@dnyw4l3n13 @credfeto