build(ci): pin GitHub Actions to commit SHAs - #3
Open
crypto-titan wants to merge 1 commit into
Open
Conversation
A mutable tag like @v4 is repointed by the action's maintainer, so a compromised or coerced upstream account can change what runs inside our jobs. Pinning to the commit SHA the tag resolves to today removes that path without changing the code that executes. No version bumps: every SHA here is what the existing ref already pointed at, so this is a supply-chain change only. The trailing comment keeps the human-readable version visible and gives Dependabot the anchor it needs to propose future bumps. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This was referenced Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pins every
uses:reference in.github/workflows/to the commit SHA its current tag resolves to, with the version preserved as a trailing comment.This is a supply-chain change only — no version bumps. Every SHA here is what
@v4/@v5/@stablealready pointed at, so the exact same code runs after this merge as before it.Why
A tag is a mutable pointer owned by the action's maintainer.
@v4can be repointed at any time — by the maintainer, or by anyone who compromises their account. Every job here checks out our source and some hold release credentials, so "whatever@v4means today" is an unreviewed dependency on ~10 external accounts staying uncompromised. A SHA cannot be repointed.This is the mitigation for the class of attack behind
tj-actions/changed-files(CVE-2025-30066), where a repointed tag exfiltrated secrets from tens of thousands of repos.Notes specific to this repo
dtolnay/rust-toolchain@stablewas a branch ref, not a tag — strictly worse than a version tag, since any push to that branch changed what ran. Now pinned. This freezes the action implementation, not the Rust version: the action shells out torustup toolchain installat run time, so Rust stable still floats as before.golangci/golangci-lint-actionstays on v8 deliberately. v9 is available but requires golangci-lint v2 config format — that's a separate change.What this does not do
Pinning freezes the code but doesn't review it. Upgrades now require an explicit SHA change, which is the point — but it also means security patches no longer arrive silently. Enabling Dependabot for
github-actionsis the intended follow-up; it parses the# v4comment and raises PRs against these pins.Test plan
release-proof-helper.ymlstill builds the Rust helper