[PR #92] [MERGED] ci: pin every bare actions/*@vN reference to a full commit SHA (BE-5121) #103

New issue

Closed

opened 2026-10-26 22:36:15 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:36:15 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/92
Author: @mattmillerai
Created: 7/29/2026
Status: ✅ Merged
Merged: 7/31/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-5121-pin-actions-sha

📝 Commits (2)

7a0c973 ci: pin every bare actions/*@vN reference to a full commit SHA (BE-5121)
d95f4b2 Merge remote-tracking branch 'origin/main' into matt/be-5121-pin-actions-sha

📊 Changes

7 files changed (+20 additions, -20 deletions)

View changed files

📝 .github/workflows/agents-md-integrity.yml (+3 -3)
📝 .github/workflows/assign-prs-to-author.yml (+1 -1)
📝 .github/workflows/cursor-review-auto-label.yml (+1 -1)
📝 .github/workflows/cursor-review.yml (+10 -10)
📝 .github/workflows/test-agents-md-integrity.yml (+2 -2)
📝 .github/workflows/test-bump-callers.yml (+1 -1)
📝 .github/workflows/test-cursor-review-scripts.yml (+2 -2)

📄 Description

ELI-5

GitHub Actions lets you say "run version 7 of the checkout action". But v7 is just a sticky note that whoever owns the action can move to point at different code whenever they like. If someone hostile (or just careless) moves it, our CI silently starts running something else — and because this repo publishes reusable workflows, that change would ride along into every consumer repo that calls them. This PR replaces each sticky note with the exact commit it currently points at, and leaves a # v7.0.1-style comment so a human can still read which version it is.

What changed

Twenty uses: lines across seven workflow files went from a bare tag to a full 40-character commit SHA with a trailing version comment. No other change — no logic, no inputs, no permissions.

Action	Was	Now
`actions/checkout`	`@v7`	`@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`
`actions/setup-python`	`@v7`	`@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0`
`actions/upload-artifact`	`@v7`	`@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7`
`actions/download-artifact`	`@v8`	`@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8`
`actions/create-github-app-token`	`@v3.2.0`	`@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0`
`actions/github-script`	`@v9.0.0`	`@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0`

Files: cursor-review.yml, cursor-review-auto-label.yml, agents-md-integrity.yml, assign-prs-to-author.yml, test-cursor-review-scripts.yml, test-agents-md-integrity.yml, test-bump-callers.yml.

Merged with main after Dependabot #95. This PR originally pinned the v6 SHAs of checkout/setup-python. While it was open, #95 (github-actions-major group) bumped those same lines to v7 and moved github-script/create-github-app-token to exact tags — conflicting on every line this PR touches. The conflict was resolved by keeping the base's newer version, pinned to that version's SHA, so neither intent was lost: taking our side alone would have re-pinned the superseded v6, taking theirs alone would have left the refs on floating tags. Every SHA above is the one main already uses for that action elsewhere, so the repo is now on a single SHA per action with no split pins.

Why

AGENTS.md: "Pin everything by full commit SHA, with a trailing # v1 comment — both the uses: in callers and every third-party action here." These seven files were the remaining exceptions. The motivation is the repo's own stated standard plus mutable-tag supply-chain risk — not a failing check: the pinact/zizmor validation consumer repos run inspects the consumer's own caller files, not this reusable workflow's internal action refs, so nothing is red today.

Raised on #91 (https://github.com/Comfy-Org/github-workflows/pull/91#discussion_r3672144679) and deferred there, because pinning only the four lines that PR added would have left cursor-review.yml internally inconsistent while fixing nothing.

How the SHAs were chosen

Every SHA is one this repo already uses elsewhere for the same version, so the pins are internally consistent rather than newly invented. Each was then independently confirmed against the live tag via the tags API — both sources agreed on all six. Since each pin resolves to the tip the tag points at today, the same code runs before and after: no behaviour change is expected.

Verification

grep -rnE 'uses: actions/[a-z-]*@v[0-9.]*$' .github/workflows/ → no matches (the ticket's acceptance check).
Broader sweep — every uses: line in .github/workflows/ now carries a 40-hex SHA, with these deliberate exceptions: ci-groom.yml:95, whose @REPLACE_AT_MERGE_WITH_THIS_PRS_SQUASH_SHA placeholder is the documented bump-at-merge marker; the @<sha> placeholders inside doc comments; and this repo's own self-references, which dependabot.yml deliberately ignores and bump-callers.sh owns.
All suites green locally on the merged tree: cursor-review scripts (40 tests), groom (120), agents-md-integrity (18), bump-callers (shellcheck clean + 123 assertions), and go test ./... for scripts/check-pr-size.
Every workflow file re-parses as YAML.
CI on the merge commit is green — and the three workflows whose uses: lines changed (test-cursor-review-scripts, test-agents-md-integrity, test-bump-callers) each executed the new checkout@v7.0.1 / setup-python@v7.0.0 pins and passed, so the SHAs are proven by running, not only by tag lookup.

Judgment calls

Comment version granularity follows in-repo precedent, not one uniform rule. checkout/setup-python get the exact version (# v7.0.1 / # v7.0.0) because main is already uniform that way for those two actions — 21 occurrences, zero major-only — and it is what Dependabot itself writes on a bump; major-only here would have been the odd one out and would churn on the next bump. upload-artifact/download-artifact keep # v7/# v8 and create-github-app-token/github-script keep # v3.2.0/# v9.0.0, matching what the existing pinned lines in this repo already say for those SHAs. Uniformity across actions would have meant rewriting lines outside this PR's scope.
ci-groom.yml left alone — see above; it is the intentional placeholder, and it is not an actions/* ref.
The ticket's per-file counts do not match the code. It describes cursor-review.yml as carrying 13 checkout@v6, 2 upload-artifact@v7, 3 download-artifact@v8 and 1 create-github-app-token@v3; the file has since moved (twice — the #91 review, then #95). The acceptance criterion is the grep, which is satisfied — but flagging the discrepancy rather than quietly reconciling it.
Not a capability-denying change (no deny/dead-end path, no "unsupported" string), so the negative-claim falsification requirement does not apply.

Risk

The riskiest thing here is a single mistyped SHA, which would fail every affected job loudly and immediately rather than degrade silently. That risk is covered by the two-source check above plus CI having actually run the new pins. Consumers are unaffected either way — they pin this repo by SHA, so nothing changes for them until they bump.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/92 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/29/2026 **Status:** ✅ Merged **Merged:** 7/31/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-5121-pin-actions-sha` --- ### 📝 Commits (2) - [`7a0c973`](https://github.com/Comfy-Org/github-workflows/commit/7a0c9731cb73cc41d11c459063acdb85e3bed9d4) ci: pin every bare actions/*@vN reference to a full commit SHA (BE-5121) - [`d95f4b2`](https://github.com/Comfy-Org/github-workflows/commit/d95f4b252891622d3813cf7a777b478775fb65f2) Merge remote-tracking branch 'origin/main' into matt/be-5121-pin-actions-sha ### 📊 Changes **7 files changed** (+20 additions, -20 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/agents-md-integrity.yml` (+3 -3) 📝 `.github/workflows/assign-prs-to-author.yml` (+1 -1) 📝 `.github/workflows/cursor-review-auto-label.yml` (+1 -1) 📝 `.github/workflows/cursor-review.yml` (+10 -10) 📝 `.github/workflows/test-agents-md-integrity.yml` (+2 -2) 📝 `.github/workflows/test-bump-callers.yml` (+1 -1) 📝 `.github/workflows/test-cursor-review-scripts.yml` (+2 -2) </details> ### 📄 Description ## ELI-5 GitHub Actions lets you say "run version 7 of the checkout action". But `v7` is just a sticky note that whoever owns the action can move to point at different code whenever they like. If someone hostile (or just careless) moves it, our CI silently starts running something else — and because this repo publishes *reusable* workflows, that change would ride along into every consumer repo that calls them. This PR replaces each sticky note with the exact commit it currently points at, and leaves a `# v7.0.1`-style comment so a human can still read which version it is. ## What changed Twenty `uses:` lines across seven workflow files went from a bare tag to a full 40-character commit SHA with a trailing version comment. No other change — no logic, no inputs, no permissions. | Action | Was | Now | |---|---|---| | `actions/checkout` | `@v7` | `@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1` | | `actions/setup-python` | `@v7` | `@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0` | | `actions/upload-artifact` | `@v7` | `@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7` | | `actions/download-artifact` | `@v8` | `@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8` | | `actions/create-github-app-token` | `@v3.2.0` | `@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0` | | `actions/github-script` | `@v9.0.0` | `@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0` | Files: `cursor-review.yml`, `cursor-review-auto-label.yml`, `agents-md-integrity.yml`, `assign-prs-to-author.yml`, `test-cursor-review-scripts.yml`, `test-agents-md-integrity.yml`, `test-bump-callers.yml`. > **Merged with `main` after Dependabot #95.** This PR originally pinned the **v6** SHAs of `checkout`/`setup-python`. While it was open, #95 (`github-actions-major` group) bumped those same lines to **v7** and moved `github-script`/`create-github-app-token` to exact tags — conflicting on every line this PR touches. The conflict was resolved by keeping **the base's newer version, pinned to that version's SHA**, so neither intent was lost: taking our side alone would have re-pinned the superseded v6, taking theirs alone would have left the refs on floating tags. Every SHA above is the one `main` already uses for that action elsewhere, so the repo is now on a single SHA per action with no split pins. ## Why `AGENTS.md`: "Pin everything by full commit SHA, with a trailing `# v1` comment — both the `uses:` in callers and every third-party action here." These seven files were the remaining exceptions. The motivation is the repo's own stated standard plus mutable-tag supply-chain risk — **not** a failing check: the `pinact`/`zizmor` validation consumer repos run inspects the *consumer's own caller files*, not this reusable workflow's internal action refs, so nothing is red today. Raised on #91 (https://github.com/Comfy-Org/github-workflows/pull/91#discussion_r3672144679) and deferred there, because pinning only the four lines that PR added would have left `cursor-review.yml` internally inconsistent while fixing nothing. ## How the SHAs were chosen Every SHA is one this repo **already uses** elsewhere for the same version, so the pins are internally consistent rather than newly invented. Each was then independently confirmed against the live tag via the tags API — both sources agreed on all six. Since each pin resolves to the tip the tag points at today, the same code runs before and after: no behaviour change is expected. ## Verification - `grep -rnE 'uses: actions/[a-z-]*@v[0-9.]*$' .github/workflows/` → no matches (the ticket's acceptance check). - Broader sweep — every `uses:` line in `.github/workflows/` now carries a 40-hex SHA, with these deliberate exceptions: `ci-groom.yml:95`, whose `@REPLACE_AT_MERGE_WITH_THIS_PRS_SQUASH_SHA` placeholder is the documented bump-at-merge marker; the `@<sha>` placeholders inside doc comments; and this repo's own self-references, which `dependabot.yml` deliberately ignores and `bump-callers.sh` owns. - All suites green locally on the merged tree: cursor-review scripts (40 tests), groom (120), agents-md-integrity (18), bump-callers (`shellcheck` clean + 123 assertions), and `go test ./...` for `scripts/check-pr-size`. - Every workflow file re-parses as YAML. - CI on the merge commit is green — and the three workflows whose `uses:` lines changed (`test-cursor-review-scripts`, `test-agents-md-integrity`, `test-bump-callers`) each *executed* the new `checkout@v7.0.1` / `setup-python@v7.0.0` pins and passed, so the SHAs are proven by running, not only by tag lookup. ## Judgment calls - **Comment version granularity follows in-repo precedent, not one uniform rule.** `checkout`/`setup-python` get the exact version (`# v7.0.1` / `# v7.0.0`) because `main` is already uniform that way for those two actions — 21 occurrences, zero major-only — and it is what Dependabot itself writes on a bump; major-only here would have been the odd one out and would churn on the next bump. `upload-artifact`/`download-artifact` keep `# v7`/`# v8` and `create-github-app-token`/`github-script` keep `# v3.2.0`/`# v9.0.0`, matching what the existing pinned lines in this repo already say for those SHAs. Uniformity *across* actions would have meant rewriting lines outside this PR's scope. - **`ci-groom.yml` left alone** — see above; it is the intentional placeholder, and it is not an `actions/*` ref. - **The ticket's per-file counts do not match the code.** It describes `cursor-review.yml` as carrying 13 `checkout@v6`, 2 `upload-artifact@v7`, 3 `download-artifact@v8` and 1 `create-github-app-token@v3`; the file has since moved (twice — the #91 review, then #95). The acceptance criterion is the grep, which is satisfied — but flagging the discrepancy rather than quietly reconciling it. - Not a capability-denying change (no deny/dead-end path, no "unsupported" string), so the negative-claim falsification requirement does not apply. ## Risk The riskiest thing here is a single mistyped SHA, which would fail every affected job loudly and immediately rather than degrade silently. That risk is covered by the two-source check above plus CI having actually run the new pins. Consumers are unaffected either way — they pin *this repo* by SHA, so nothing changes for them until they bump. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:36:15 +00:00