[PR #1901] [MERGED] ci: pin GitHub Actions to full commit SHAs #4892

New issue

Closed

opened 2026-10-31 00:56:30 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:56:30 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1901
Author: @larinyo
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: pr/pin-actions-to-sha

📝 Commits (4)

04d5b37 ci: pin GitHub Actions to full commit SHAs
574e2dd Merge upstream main (51d6c87c) into pr/pin-actions-to-sha
c7e8a7b ci: retain action pins across main workflow updates
f439ebe style(ci): format action identity assertion

📊 Changes

26 files changed (+134 additions, -130 deletions)

View changed files

📝 .github/actions/portable-build-cache/action.yml (+3 -3)
📝 .github/workflows/ci-timings.yml (+3 -3)
📝 .github/workflows/ci.yml (+48 -48)
📝 .github/workflows/nativeaot-fixtures.yml (+4 -4)
📝 .github/workflows/pages.yml (+2 -2)
📝 .github/workflows/real-binary-layout.yml (+2 -2)
📝 .github/workflows/real-browser.yml (+2 -2)
📝 .github/workflows/real-evm-interface.yml (+2 -2)
📝 .github/workflows/real-ghidra-windows.yml (+7 -7)
📝 .github/workflows/real-go-binary.yml (+3 -3)
📝 .github/workflows/real-hopper-linux.yml (+4 -4)
📝 .github/workflows/real-hopper.yml (+2 -2)
📝 .github/workflows/real-javascript-recovery.yml (+2 -2)
📝 .github/workflows/real-packet-capture.yml (+2 -2)
📝 .github/workflows/real-recorded-crash.yml (+2 -2)
📝 .github/workflows/real-signal-recording.yml (+2 -2)
📝 .github/workflows/real-termux.yml (+3 -3)
📝 .github/workflows/real-web-network-captures.yml (+2 -2)
📝 .github/workflows/real-web-runtime.yml (+2 -2)
📝 .github/workflows/real-web-source-map.yml (+2 -2)

...and 6 more files

📄 Description

Summary

Every third-party uses: owner/repo@vN in .github/workflows is replaced with the 40-character commit SHA that the tag currently resolves to. The exact release is kept as a trailing comment (for example actions/checkout@11d5960a… # v4.4.0). Floating tags can be moved by whoever controls the action repository, and release.yml holds npm and MCP Registry publication credentials.

Change and scope

The pins, each checked with git ls-remote --tags; in every case vN^{} and vX.Y.Z^{} are the same commit:

Action	Floating tag	Pinned release	Commit
actions/checkout	v4	v4.4.0	`11d5960a326750d5838078e36cf38b85af677262`
actions/checkout	v6	v6.1.0	`d23441a48e516b6c34aea4fa41551a30e30af803`
actions/setup-node	v4	v4.4.0	`49933ea5288caeca8642d1e84afbd3f7d6820020`
actions/setup-node	v6	v6.5.0	`249970729cb0ef3589644e2896645e5dc5ba9c38`
actions/upload-artifact	v4	v4.6.2	`ea165f8d65b6e75b540449e92b4886f43607fa02`
actions/download-artifact	v4	v4.3.0	`d3f86a106a0bac45b974a628896c90dbdf5c8093`
actions/setup-dotnet	v4	v4.3.1	`67a3573c9a986a3f9c594539f4ab511d57bb3ce9`
actions/setup-python	v5	v5.6.0	`a26af69be951a213d495a4c3e4e4022e16d87065`
actions/configure-pages	v5	v5.0.0	`983d7736d9b0ae728b81ab479565c72886d7745b`
actions/upload-pages-artifact	v4	v4.0.0	`7b1f4a764d45c48632c6b24a0339c27f5614fb0b`
actions/deploy-pages	v4	v4.0.5	`d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e`
googleapis/release-please-action	v4	v4.4.1	`5c625bfb5d1ff62eadeeb3772007f7f66fdcf071`
cloudflare/wrangler-action	v4	v4.1.3	`953926a2e2182532811c01a25e53647d93bf07c0`
reactivecircus/android-emulator-runner	(was `4c44018e…`, the annotated `v2` tag object)	v2.38.0	`a421e43855164a8197daf9d8d40fe71c6996bb0d`

android-emulator-runner was already pinned, but to the SHA of the annotated tag object (refs/tags/v2), not to the commit (refs/tags/v2^{}). Actions resolves both. Only the commit SHA can be compared against the release, and some tooling (Dependabot, pin checkers) does not treat tag-object SHAs as pins.
tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts now requires SHA-pinned setup-node and upload-artifact in the Windows Ghidra workflow.
The pins were applied to the current workflows on main, including the shard and cache changes in 40b37aee and the website workflow from a2d3338e. Local reusable workflows (./.github/workflows/*.yml) are unchanged. No job conditions, permissions or steps change.

Contract and boundary impact

CI only. No package, runtime or contract impact.

Evidence and regression coverage

Tests updated: realGhidraWindowsWorkflow.test.ts.
Check: no uses: line outside local workflows lacks a @<40-hex> # vX.Y.Z pin.

Validation performed

actionlint v1.7.7 with -shellcheck= -pyflakes= (the same flags as CI): no findings.
YAML parse of all 18 workflow files (yaml package): OK.
npx vitest run tests/boundary/filesystem/ciChangeScope.test.ts tests/boundary/filesystem/releaseCheckpoint.test.ts tests/boundary/filesystem/releaseWorkflow.test.ts tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts: 130 passed.
npx vitest run tests/process-global/curatedWindowsLane.test.ts: 2 passed.
npx oxlint: 0 errors. npm run format: no changes.

Compatibility, safety, and release

Breaking changes or migration steps: none. Future action updates need a SHA bump. Dependabot's github-actions ecosystem understands @sha # vX.Y.Z comments, if maintainers want it.
Real CI coverage: these workflows did not run on GitHub as part of this change.
Security review: this reduces the supply-chain exposure of the release and publication jobs.

Limits / not verified

No GitHub-hosted run of the pinned workflows.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1901 **Author:** [@larinyo](https://github.com/larinyo) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `pr/pin-actions-to-sha` --- ### 📝 Commits (4) - [`04d5b37`](https://github.com/morluto/rea/commit/04d5b374ffc187b68935ac08f6f56c4d29349f95) ci: pin GitHub Actions to full commit SHAs - [`574e2dd`](https://github.com/morluto/rea/commit/574e2ddc86c3c66b309f2490464b4eead6f64e25) Merge upstream main (51d6c87c) into pr/pin-actions-to-sha - [`c7e8a7b`](https://github.com/morluto/rea/commit/c7e8a7bac44470588f840ff9bf6da5dc69e50f59) ci: retain action pins across main workflow updates - [`f439ebe`](https://github.com/morluto/rea/commit/f439ebe381f105aee0525a69d9de62dde881dba7) style(ci): format action identity assertion ### 📊 Changes **26 files changed** (+134 additions, -130 deletions) <details> <summary>View changed files</summary> 📝 `.github/actions/portable-build-cache/action.yml` (+3 -3) 📝 `.github/workflows/ci-timings.yml` (+3 -3) 📝 `.github/workflows/ci.yml` (+48 -48) 📝 `.github/workflows/nativeaot-fixtures.yml` (+4 -4) 📝 `.github/workflows/pages.yml` (+2 -2) 📝 `.github/workflows/real-binary-layout.yml` (+2 -2) 📝 `.github/workflows/real-browser.yml` (+2 -2) 📝 `.github/workflows/real-evm-interface.yml` (+2 -2) 📝 `.github/workflows/real-ghidra-windows.yml` (+7 -7) 📝 `.github/workflows/real-go-binary.yml` (+3 -3) 📝 `.github/workflows/real-hopper-linux.yml` (+4 -4) 📝 `.github/workflows/real-hopper.yml` (+2 -2) 📝 `.github/workflows/real-javascript-recovery.yml` (+2 -2) 📝 `.github/workflows/real-packet-capture.yml` (+2 -2) 📝 `.github/workflows/real-recorded-crash.yml` (+2 -2) 📝 `.github/workflows/real-signal-recording.yml` (+2 -2) 📝 `.github/workflows/real-termux.yml` (+3 -3) 📝 `.github/workflows/real-web-network-captures.yml` (+2 -2) 📝 `.github/workflows/real-web-runtime.yml` (+2 -2) 📝 `.github/workflows/real-web-source-map.yml` (+2 -2) _...and 6 more files_ </details> ### 📄 Description ## Summary Every third-party `uses: owner/repo@vN` in `.github/workflows` is replaced with the 40-character commit SHA that the tag currently resolves to. The exact release is kept as a trailing comment (for example `actions/checkout@11d5960a… # v4.4.0`). Floating tags can be moved by whoever controls the action repository, and `release.yml` holds npm and MCP Registry publication credentials. ## Change and scope The pins, each checked with `git ls-remote --tags`; in every case `vN^{}` and `vX.Y.Z^{}` are the same commit: | Action | Floating tag | Pinned release | Commit | |---|---|---|---| | actions/checkout | v4 | v4.4.0 | `11d5960a326750d5838078e36cf38b85af677262` | | actions/checkout | v6 | v6.1.0 | `d23441a48e516b6c34aea4fa41551a30e30af803` | | actions/setup-node | v4 | v4.4.0 | `49933ea5288caeca8642d1e84afbd3f7d6820020` | | actions/setup-node | v6 | v6.5.0 | `249970729cb0ef3589644e2896645e5dc5ba9c38` | | actions/upload-artifact | v4 | v4.6.2 | `ea165f8d65b6e75b540449e92b4886f43607fa02` | | actions/download-artifact | v4 | v4.3.0 | `d3f86a106a0bac45b974a628896c90dbdf5c8093` | | actions/setup-dotnet | v4 | v4.3.1 | `67a3573c9a986a3f9c594539f4ab511d57bb3ce9` | | actions/setup-python | v5 | v5.6.0 | `a26af69be951a213d495a4c3e4e4022e16d87065` | | actions/configure-pages | v5 | v5.0.0 | `983d7736d9b0ae728b81ab479565c72886d7745b` | | actions/upload-pages-artifact | v4 | v4.0.0 | `7b1f4a764d45c48632c6b24a0339c27f5614fb0b` | | actions/deploy-pages | v4 | v4.0.5 | `d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e` | | googleapis/release-please-action | v4 | v4.4.1 | `5c625bfb5d1ff62eadeeb3772007f7f66fdcf071` | | cloudflare/wrangler-action | v4 | v4.1.3 | `953926a2e2182532811c01a25e53647d93bf07c0` | | reactivecircus/android-emulator-runner | (was `4c44018e…`, the annotated `v2` tag object) | v2.38.0 | `a421e43855164a8197daf9d8d40fe71c6996bb0d` | - `android-emulator-runner` was already pinned, but to the SHA of the annotated tag *object* (`refs/tags/v2`), not to the commit (`refs/tags/v2^{}`). Actions resolves both. Only the commit SHA can be compared against the release, and some tooling (Dependabot, pin checkers) does not treat tag-object SHAs as pins. - `tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts` now requires SHA-pinned `setup-node` and `upload-artifact` in the Windows Ghidra workflow. - The pins were applied to the current workflows on `main`, including the shard and cache changes in 40b37aee and the website workflow from a2d3338e. Local reusable workflows (`./.github/workflows/*.yml`) are unchanged. No job conditions, permissions or steps change. ## Contract and boundary impact - CI only. No package, runtime or contract impact. ## Evidence and regression coverage - Tests updated: `realGhidraWindowsWorkflow.test.ts`. - Check: no `uses:` line outside local workflows lacks a `@<40-hex> # vX.Y.Z` pin. ## Validation performed - `actionlint` v1.7.7 with `-shellcheck= -pyflakes=` (the same flags as CI): no findings. - YAML parse of all 18 workflow files (`yaml` package): OK. - `npx vitest run tests/boundary/filesystem/ciChangeScope.test.ts tests/boundary/filesystem/releaseCheckpoint.test.ts tests/boundary/filesystem/releaseWorkflow.test.ts tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts`: 130 passed. - `npx vitest run tests/process-global/curatedWindowsLane.test.ts`: 2 passed. - `npx oxlint`: 0 errors. `npm run format`: no changes. ## Compatibility, safety, and release - Breaking changes or migration steps: none. Future action updates need a SHA bump. Dependabot's `github-actions` ecosystem understands `@sha # vX.Y.Z` comments, if maintainers want it. - Real CI coverage: these workflows did not run on GitHub as part of this change. - Security review: this reduces the supply-chain exposure of the release and publication jobs. ## Limits / not verified - No GitHub-hosted run of the pinned workflows. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:56:30 +00:00