ci: pin actions to SHAs and add dependabot#260
Merged
Conversation
Pin every external `uses: owner/action@tag` in .github/workflows/ to a full 40-char commit SHA, keeping the version tag as a trailing comment so humans and Dependabot can still read the intended version. SHA pinning is the GitHub-recommended hardening for third-party actions: a moving tag can be repointed at malicious code, a commit SHA cannot. dependabot.yml already declares the github-actions ecosystem (weekly), so it will keep these pins current by bumping the SHA + comment together. No dependabot change needed. Local reusable-workflow ref (./.github/workflows/release_desktop.yml) is left as-is; only external references are pinned. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
🚀 PWA Preview DeploymentYour PWA preview has been deployed! Preview URL: https://niivue.github.io/niivue-vscode/pr-260/ This preview will be updated automatically when you push new commits to this PR. |
Contributor
🧹 PWA Preview CleanupThe preview deployment for this PR has been removed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pin every external GitHub Action in
.github/workflows/from a moving tag (uses: owner/action@v6) to a full 40-char commit SHA, with the version tag preserved as a trailing comment:git ls-remote(annotated tags dereferenced with^{}to the underlying commit) and each verified to be exactly 40 hex chars.uses: ./.github/workflows/release_desktop.ymlis intentionally left unpinned (local refs aren't pinnable).Why
A version tag can be silently repointed at malicious code; a commit SHA cannot. This is the GitHub-recommended hardening for third-party actions and closes a supply-chain gap.
Dependabot
.github/dependabot.ymlalready declares thegithub-actionsecosystem on a weekly schedule, so no change was needed there. Dependabot understands SHA pins and will bump the SHA + the trailing version comment together, keeping the pins current.Verification
with:,if:, or permission keys touched.🤖 Generated with Claude Code