fix(ci): pin desktop release actions to immutable commit SHAs

[polylane]

Fixes: cache-app desktop installers are built from mutable action refs and published unsigned

Cache's desktop release workflow fetched its third-party build actions from mutable tags and a moving branch. Whoever controls one of those refs could change the code the release job runs, and that job can rewrite the installer assets the product site offers for download. Each action is now pinned to a fixed commit, so the code executed during a release can no longer change underneath the build.

flowchart LR
    Ref["Action ref (mutable tag or branch)"] --> Run["Release job runs third-party code"]
    Run --> Write["contents write: release assets replaceable"]
    Write --> Dl["cachd.app offers installers"]
    Dl --> User["User runs the binary"]
    Pin["Fix: pin every action to a commit SHA"] -.-> Ref

Loading

What caused this

Affected: int_0b563423d00164u048hh0syk

Why this fix

GitHub's API reports sha_pinning_required: false and allowed_actions: "all" for this repository, so nothing stopped the release workflow from resolving its third-party actions from mutable refs. Two of its eight uses: entries pointed at a moving branch and moving major tags, and the job that runs them holds contents: write and attaches the installer assets the product site links as the official downloads. A change to any of those refs would therefore run inside a context that can replace the binaries end users execute, with no signature or checksum to notice.

Pinning each action to the commit its current tag points to removes that path: the code executed during a release is fixed at review time and can only move through a reviewed change. The pinned commits were resolved from the actions' own repositories and each was confirmed against the commits API; the version is kept in a trailing comment so a pin stays readable. No other workflow behavior changes.

This change does not sign the installers or add a checksum the site verifies, set the repository's sha_pinning_required policy, add an approval gate, or watch the release path. Those need signing keys and GitHub settings that are not repository code, and they remain open on the issue.

Out of scope

• Installer signing/notarization and a checksum or attestation the site verifies: needs signing keys and a trust anchor for client-side verification; recorded as remaining work on the issue.
• Repository Actions policy (sha_pinning_required, allowed_actions) and release environment protection rules: live in GitHub settings, not repository code.
• Dependabot config to keep the pins current: no Dependabot config file exists in the repository to extend.

1 file changed (+12/-8)

• .github/workflows/desktop-release.yml: modified, +12/-8

---

Generated by Polylane. You can ask follow-ups by mentioning @polylane in a comment.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 293c4b83-bf78-42e7-87bb-44da6963beb4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cache-app	Ready	Preview	Sep 19, 2026 7:30pm UTC

[polylane]

Note

Production impact unlikely.

Documentation, test, or CI-only change; nothing that runs in production is affected.

_{Polylane analysed 919e80d for production impact. You can ask follow-ups by mentioning @polylane in a comment.}

Rate this review: 👍 helpful · 👎 not helpful · 😕 confusing