Add full commit sha instead of tags in workflow#2908
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2908 +/- ##
=======================================
Coverage 72.49% 72.49%
=======================================
Files 258 258
Lines 31471 31471
Branches 2973 2973
=======================================
Hits 22814 22814
Misses 7647 7647
Partials 1010 1010 ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Pull request overview
Pins GitHub Actions used by the repo’s CI/lint/pages/code-scanning workflows to immutable commit SHAs (instead of mutable version tags) to reduce supply-chain risk (fixes #2903).
Changes:
- Replaces
uses: ...@v*references with full commit SHAs across core workflows. - Pins Codecov and Reviewdog actions used in CI and linting.
- Pins CodeQL init/autobuild/analyze steps used for code scanning.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/pages.yaml | Pins Pages-related actions to SHAs (checkout/configure-pages/setup-python/upload-pages-artifact/deploy-pages). |
| .github/workflows/main.yaml | Pins CI actions to SHAs (checkout/setup-python/codecov/test-results/upload-artifact). |
| .github/workflows/lint.yaml | Pins lint workflow actions to SHAs (checkout/reviewdog actions/setup-python). |
| .github/workflows/codeql-analysis.yml | Pins CodeQL scanning actions (checkout + codeql init/autobuild/analyze) to SHAs. |
| with: | ||
| python-version: "3.10" | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - name: Setup Python | ||
| uses: actions/setup-python@v6 | ||
| uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6 | ||
| with: |
|
I rethought about this: I find having to bump the sha constantly a maintenance burden, even with dependabot. I am inline to leave the trusted workflows not pinned with sha. Thanks and sorry for the churn. |
|
thanks 😊 i understand, please feel free to close this PR or let me know if i should do . |
fixes #2903