ci: pin GitHub Actions to commit SHAs for supply-chain hardening#327
Open
Rishi943 wants to merge 1 commit into
Open
ci: pin GitHub Actions to commit SHAs for supply-chain hardening#327Rishi943 wants to merge 1 commit into
Rishi943 wants to merge 1 commit into
Conversation
Pin all third-party actions in ci.yml, docs.yml, and publish.yml to full commit SHAs with human-readable version comments, and replace pagefind@latest with pagefind@1.5.2, so workflow dependencies are reproducible and resistant to tag-move attacks. Follow-up to huggingface#189. Closes huggingface#199 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Closes #199.
Follow-up hardening pass after #189 (Dependabot weekly actions updates): pin every third-party GitHub Action to a full commit SHA so workflow dependencies are reproducible and resistant to tag-move attacks, per the acceptance criteria in the issue.
Changes
All third-party actions in
.github/workflows/are now pinned to full commit SHAs, each with a human-readable version comment:actions/checkout9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0actions/setup-pythonece7cb06caefa5fff74198d8649806c4678c61a1astral-sh/setup-uvfac544c07dec837d0ccb6301d7b5580bf5edae39peaceiris/actions-hugo2752ce1d29631191ea3f27c23495fa06139a5b78actions/upload-pages-artifactfc324d3547104276b827a68afc52ff2a11cc49c9actions/deploy-pagescd2ce8fcbc39b97be8ca5fce6e763baed58fa128Each SHA was resolved from the action's own repository via the GitHub API (
repos/<action>/commits/<tag>) and cross-checked against the exact release tag pointing at that commit.Runtime-version notes:
oven-sh/setup-bun@v2/bun-version: latest, but the workflows have since moved to Hugo + Pagefind, so there is no Bun reference left to pin. The remaining floating runtime wasnpx --yes pagefind@latestin the CI and docs workflows — replaced withpagefind@1.5.2(current release) in both.hugo-versionwas already pinned to0.152.2; Python resolves from.python-version; both left as-is.Dependabot (from #189) already groups weekly
github-actionsupdates and understands SHA + version-comment pinning, so these stay current automatically.Scope
Per the automation-pass note on the issue, this first pass only pins existing actions and runtime versions. It does not add an enforcement check — happy to follow up with
pinact(or a lightweight CI grep) in a separate PR if you want the policy enforced going forward.Checks
uses:/run:version strings).uv run pytest,ruff check,ruff format --checkunaffected (no Python changes); CI on this PR exercises the pinned actions directly.🤖 Disclosure: analysis and edits by Claude Code (Claude Fable 5), working as my pair-programming agent — SHA resolution done against each action's own repo via the GitHub API, not copied from docs. Reviewed and submitted by me (@Rishi943).