🔒 Pin GitHub Actions to commit SHAs by paulinebm · Pull Request #113 · huggingface/llm-ls

paulinebm · 2026-04-02T09:38:52Z

🔒 Pin GitHub Actions to commit SHAs

This PR pins all GitHub Actions to their exact commit SHA instead of mutable tags or branch names.

Why?
Pinning to a SHA prevents supply chain attacks where a tag (e.g. v4) could be moved to point to malicious code.

Changes

Workflow	Action	Avant	Après	SHA
`test.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`test.yml`	`dtolnay/rust-toolchain`	`stable`	`stable`	`29eef336d9b2…`
`test.yml`	`actions/setup-python`	`v5`	`v5`	`a26af69be951…`
`test.yml`	`actions/setup-node`	`v4`	`v4`	`49933ea5288c…`
`test.yml`	`actions/cache`	`v4`	`v4`	`0057852bfaa8…`
`test.yml`	`actions/upload-artifact`	`v4`	`v4`	`ea165f8d65b6…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`test.yml`	`peter-evans/find-comment`	`v2`	`v2`	`a54c31d7fa09…`
`test.yml`	`peter-evans/create-or-update-comment`	`v3`	`v3`	`23ff15729ef2…`
`release.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`release.yml`	`actions/upload-artifact`	`v4`	`v4`	`ea165f8d65b6…`
`release.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`release.yml`	`actions/upload-artifact`	`v4`	`v4`	`ea165f8d65b6…`
`release.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`release.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`release.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`release.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`release.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`release.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`release.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`release.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`release.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`release.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`

🤖 Generated by /github-actions-audit — [security/pin-actions-to-sha]

Closes huggingface/tracking-issues#167

paulinebm added 2 commits April 2, 2026 11:38

🔒 pin test.yml actions to commit SHAs

38c49ac

🔒 pin release.yml actions to commit SHAs

faee433

paulinebm marked this pull request as ready for review April 2, 2026 12:21

paulinebm merged commit 1c52b94 into main Apr 7, 2026
1 of 13 checks passed

paulinebm deleted the security/pin-actions-to-sha branch April 7, 2026 13:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🔒 Pin GitHub Actions to commit SHAs#113

🔒 Pin GitHub Actions to commit SHAs#113
paulinebm merged 2 commits intomainfrom
security/pin-actions-to-sha

paulinebm commented Apr 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

paulinebm commented Apr 2, 2026