Skip to content

ci: pin workflow actions to commit SHAs (audit MD-28) #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JOY (JOY) merged 2 commits into from
Sep 19, 2026
Merged

ci: pin workflow actions to commit SHAs (audit MD-28) #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7b69f4d
ci: pin workflow actions to commit SHAs (audit MD-28)
Sep 19, 2026
b8276e7
ci: fix actions/cache SHA (was concatenated with setup-node's)
Sep 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/actions/cache-checkout/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ runs:
using: "composite"
steps:
- name: Cache git checkout
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
id: cache-checkout
with:
path: |
Expand All @@ -16,7 +16,7 @@ runs:
key: git-checkout-${{ github.head_ref || github.ref_name }}-${{ github.event.pull_request.head.sha || github.sha }}
- name: Checkout PR code (on cache miss)
if: steps.cache-checkout.outputs.cache-hit != 'true'
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

@gemini-code-assist gemini-code-assist Bot Sep 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The comment indicates version v4.4.0, but the commit SHA 11d5960a326750d5838078e36cf38b85af677262 actually corresponds to v4.2.2 (as v4.4.0 does not exist for actions/checkout). Please update the comment to correctly reflect the version as v4.2.2 to avoid confusion.

      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2

with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
fetch-depth: 2
Expand Down
14 changes: 7 additions & 7 deletions .github/actions/yarn-install/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ runs:
using: "composite"
steps:
- name: Use Node ${{ inputs.node_version }}
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

@gemini-code-assist gemini-code-assist Bot Sep 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The commit SHA 49933ea5288caeca8642d1e84afbd3f7d6820020 is invalid and does not correspond to any release of actions/setup-node. Additionally, v4.4.0 does not exist for actions/setup-node (the latest is v4.2.0). Please use a valid commit SHA, such as 1d71962b49693772fb9c9f966958fc8f86c4cd87 for v4.2.0.

      uses: actions/setup-node@1d71962b49693772fb9c9f966958fc8f86c4cd87 # v4.2.0

with:
node-version: ${{ inputs.node_version }}
- name: Expose yarn config as "$GITHUB_OUTPUT"
Expand All @@ -37,7 +37,7 @@ runs:
# This avoids downloading ~1.2GB of cache data when we just want to verify caches exist
- name: Check yarn cache (lookup-only)
if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
uses: actions/cache/restore@v4
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
id: yarn-download-cache-check
with:
path: ${{ steps.yarn-config.outputs.CACHE_FOLDER }}
Expand All @@ -46,7 +46,7 @@ runs:

- name: Check node_modules cache (lookup-only)
if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
uses: actions/cache/restore@v4
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
id: yarn-nm-cache-check
with:
path: |
Expand All @@ -57,7 +57,7 @@ runs:

- name: Check yarn install state cache (lookup-only)
if: ${{ inputs.skip-install-if-cache-hit == 'true' }}
uses: actions/cache/restore@v4
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
id: yarn-install-state-cache-check
with:
path: .yarn/ci-cache/
Expand All @@ -83,7 +83,7 @@ runs:
# Only restore if not in skip mode, or if skip mode but any cache check missed
- name: Restore yarn cache
if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
id: yarn-download-cache
with:
path: ${{ steps.yarn-config.outputs.CACHE_FOLDER }}
Expand All @@ -93,7 +93,7 @@ runs:
- name: Restore node_modules
if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
id: yarn-nm-cache
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: |
**/node_modules/
Expand All @@ -104,7 +104,7 @@ runs:
- name: Restore yarn install state
if: ${{ inputs.skip-install-if-cache-hit != 'true' || steps.all-caches-check.outputs.all-hit != 'true' }}
id: yarn-install-state-cache
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: .yarn/ci-cache/
key: ${{ runner.os }}-yarn-install-state-cache-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/check-types.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
check-types:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
sparse-checkout: .github
- uses: ./.github/actions/cache-checkout
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/deploy-api-v2-docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,20 +20,20 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

- name: Log in to GitHub Container Registry
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and push API v2 image
uses: docker/build-push-action@v6
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
with:
context: .
file: ./apps/api/v2/Dockerfile
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/deploy-docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,13 +24,13 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

- name: Log in to GitHub Container Registry
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: ghcr.io
username: ${{ github.actor }}
Expand All @@ -43,7 +43,7 @@ jobs:
echo "image_name=${IMAGE_NAME,,}" >> $GITHUB_OUTPUT

- name: Build and push Docker image
uses: docker/build-push-action@v6
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
with:
context: .
file: ./Dockerfile
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
sparse-checkout: .github
- uses: ./.github/actions/cache-checkout
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/unit-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:
timeout-minutes: 20
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
sparse-checkout: .github
- uses: ./.github/actions/cache-checkout
Expand Down
Loading