Pin workflow actions to commit SHAs - #46
Merged
Merged
Conversation
A tag can be moved after the fact; a commit SHA cannot. Every `uses:` now names the full SHA of the release the previous tag resolved to, with that version as a trailing comment — the format Dependabot reads and rewrites, so updates keep flowing. SHA pins turn every upstream release into an update rather than only major bumps, so Dependabot's action bumps are grouped into a single weekly PR to keep the churn at today's level. Reverses the 2026-07-27 decision to accept tag refs: the 16 resulting Scorecard alerts sat permanently open on the code-scanning tab, burying anything new that lands there. Clears zizmor's unpinned-uses findings and should take Scorecard's Pinned-Dependencies check from 0 to 10.
norman-abramovitz
left a comment
norman-abramovitz
left a comment
Contributor
Author
There was a problem hiding this comment.
LGTM. Done to improve the best practices badge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins every workflow
uses:reference (16 acrossci.yml,codeql.yml,scorecard.yml) to a full commit SHA, with the release version as a trailing comment — the format Dependabot reads and rewrites, so updates keep flowing.actions/checkout3d3c42e5actions/setup-gob7ad1dadgithub/codeql-action/*f205ea1cgolangci/golangci-lint-actionba0d7d2eossf/scorecard-action2d114668Each SHA is the peeled target of the tag the workflow previously floated on, so this changes which commit runs not at all — only whether upstream can move it later.
Churn control: SHA pins turn every upstream release into an update rather than only major bumps, so
dependabot.ymlgains agroups:stanza collapsing all action bumps into one weekly PR.Why reverse the earlier tag-pin decision: the 16 resulting Scorecard findings sat permanently open as medium-severity code-scanning alerts, burying anything new that lands on that tab. This resolves the
Pinned-Dependencieshalf of #45 (expected 0 → 10 on the next Scorecard run, auto-closing those alerts); theCode-Reviewhalf remains.Verified locally:
make actionlintandmake changelog-checkpass; zizmor reports zero findings (previously 16unpinned-uses).Also carries the v1.24.0 fragment sweep commit, riding along with the next PR as
make changelog-sweepinstructs.