From d0495574eeac6b874a5c87002923b41f4e88ef02 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 23:02:16 +0000 Subject: [PATCH] fix(ci): pin third-party actions to full commit SHAs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The account's Actions policy requires a full-length SHA ref. A tag or branch ref is refused at startup — `startup_failure`, no jobs, "this workflow graph cannot be shown" — so these workflows could not run at all. This resolves each ref to the commit it currently points at and records the ref in a trailing comment, e.g. `actions/checkout@ # v4`. `dtolnay/rust-toolchain` takes its toolchain from the ref itself, so those steps also gained an explicit `with: toolchain:` input; without it, a SHA ref would silently lose the channel. No behaviour is intended to change beyond the pins. --- broad-spectrum/.github/workflows/ci.yml | 12 ++++++------ .../.github/workflows/rescript-deno-ci.yml | 4 ++-- cicada/.github/workflows/ci.yml | 14 +++++++------- czech-file-knife/.github/workflows/stress-test.yml | 4 +++- .../generator-generic-ossf-slsa3-publish.yml | 2 +- nano-aider/.github/workflows/ci.yml | 8 ++++---- panoptes/.github/workflows/rust-ci.yml | 9 +++++---- 7 files changed, 28 insertions(+), 25 deletions(-) diff --git a/broad-spectrum/.github/workflows/ci.yml b/broad-spectrum/.github/workflows/ci.yml index fd07a288..42c03461 100644 --- a/broad-spectrum/.github/workflows/ci.yml +++ b/broad-spectrum/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Setup Deno - uses: denoland/setup-deno@v1 + uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1 with: deno-version: ${{ env.DENO_VERSION }} @@ -61,7 +61,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Setup Deno - uses: denoland/setup-deno@v1 + uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1 with: deno-version: ${{ matrix.deno-version }} @@ -87,7 +87,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Setup Deno - uses: denoland/setup-deno@v1 + uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1 with: deno-version: ${{ env.DENO_VERSION }} @@ -110,7 +110,7 @@ jobs: run: deno coverage coverage --lcov > coverage.lcov - name: Upload coverage to Codecov - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3 with: files: ./coverage.lcov flags: unittests @@ -123,7 +123,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Setup Deno - uses: denoland/setup-deno@v1 + uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1 with: deno-version: ${{ env.DENO_VERSION }} @@ -184,7 +184,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - name: Setup Deno - uses: denoland/setup-deno@v1 + uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1 with: deno-version: ${{ env.DENO_VERSION }} diff --git a/broad-spectrum/.github/workflows/rescript-deno-ci.yml b/broad-spectrum/.github/workflows/rescript-deno-ci.yml index c3795c8f..5074c948 100644 --- a/broad-spectrum/.github/workflows/rescript-deno-ci.yml +++ b/broad-spectrum/.github/workflows/rescript-deno-ci.yml @@ -7,7 +7,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - uses: denoland/setup-deno@v1 + - uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1 with: deno-version: v1.x @@ -34,7 +34,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - uses: denoland/setup-deno@v1 + - uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1 - name: Check permissions run: | # Audit for dangerous permissions diff --git a/cicada/.github/workflows/ci.yml b/cicada/.github/workflows/ci.yml index 3ad96f8d..dc11beb6 100644 --- a/cicada/.github/workflows/ci.yml +++ b/cicada/.github/workflows/ci.yml @@ -28,22 +28,22 @@ jobs: with: submodules: recursive - - uses: julia-actions/setup-julia@v2 + - uses: julia-actions/setup-julia@4c0cb0fce8556fdb04a90347310e5db8b1f98fb9 # v2 with: version: ${{ matrix.version }} - - uses: julia-actions/cache@v2 + - uses: julia-actions/cache@d10a6fd8f31b12404a54613ebad242900567f2b9 # v2 - - uses: julia-actions/julia-buildpkg@v1 + - uses: julia-actions/julia-buildpkg@e3eb439fad4f9aba7da2667e7510e4a46ebc46e1 # v1 - name: Run tests run: | julia --project=. -e 'using Pkg; Pkg.test()' - - uses: julia-actions/julia-processcoverage@v1 + - uses: julia-actions/julia-processcoverage@03114f09f119417c3242a9fb6e0b722676aedf38 # v1 if: matrix.os == 'ubuntu-latest' && matrix.version == '1.9' - - uses: codecov/codecov-action@v5 + - uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 if: matrix.os == 'ubuntu-latest' && matrix.version == '1.9' with: file: lcov.info @@ -55,7 +55,7 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - uses: julia-actions/setup-julia@v2 + - uses: julia-actions/setup-julia@4c0cb0fce8556fdb04a90347310e5db8b1f98fb9 # v2 with: version: '1.9' @@ -79,7 +79,7 @@ jobs: ! grep -r "token\s*=" src/ test/ | grep -v "github_token" | grep -v "# GitHub" - name: Dependency audit - uses: julia-actions/setup-julia@v2 + uses: julia-actions/setup-julia@4c0cb0fce8556fdb04a90347310e5db8b1f98fb9 # v2 with: version: '1.9' diff --git a/czech-file-knife/.github/workflows/stress-test.yml b/czech-file-knife/.github/workflows/stress-test.yml index fe7ce8f2..38123875 100644 --- a/czech-file-knife/.github/workflows/stress-test.yml +++ b/czech-file-knife/.github/workflows/stress-test.yml @@ -13,7 +13,9 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@stable + uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable + with: + toolchain: stable - name: Install stress testing tools run: | diff --git a/monitoring/systems-observatory/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/monitoring/systems-observatory/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 63da5652..c3710e7f 100644 --- a/monitoring/systems-observatory/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/monitoring/systems-observatory/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -61,7 +61,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@68bad40844440577b33778c9f29077a3388838e9 # v1.4.0 with: base64-subjects: "${{ needs.build.outputs.digests }}" upload-assets: true # Optional: Upload to a new release diff --git a/nano-aider/.github/workflows/ci.yml b/nano-aider/.github/workflows/ci.yml index 290aeb3d..54c77d7e 100644 --- a/nano-aider/.github/workflows/ci.yml +++ b/nano-aider/.github/workflows/ci.yml @@ -37,7 +37,7 @@ jobs: run: brew install ncurses - name: Install Alire - uses: alire-project/setup-alire@v5 + uses: alire-project/setup-alire@8398015c233537c928d12293d46c0dcecb54434c # v5 with: version: ${{ env.ALIRE_VERSION }} @@ -54,7 +54,7 @@ jobs: ./ci-scripts/test.sh - name: Upload binary artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: nano-aider-${{ matrix.os }} path: bin/nano-aider @@ -74,7 +74,7 @@ jobs: sudo apt-get install -y gnat gnatprove libncurses-dev - name: Install Alire - uses: alire-project/setup-alire@v5 + uses: alire-project/setup-alire@8398015c233537c928d12293d46c0dcecb54434c # v5 with: version: ${{ env.ALIRE_VERSION }} @@ -96,7 +96,7 @@ jobs: sudo apt-get install -y gnat libncurses-dev - name: Install Alire - uses: alire-project/setup-alire@v5 + uses: alire-project/setup-alire@8398015c233537c928d12293d46c0dcecb54434c # v5 with: version: ${{ env.ALIRE_VERSION }} diff --git a/panoptes/.github/workflows/rust-ci.yml b/panoptes/.github/workflows/rust-ci.yml index 6aa1e91f..7acdf6e9 100644 --- a/panoptes/.github/workflows/rust-ci.yml +++ b/panoptes/.github/workflows/rust-ci.yml @@ -10,8 +10,9 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable with: + toolchain: stable components: rustfmt, clippy - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 @@ -31,7 +32,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - name: Install cargo-audit run: cargo install cargo-audit - name: Security audit @@ -43,11 +44,11 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable - name: Install tarpaulin run: cargo install cargo-tarpaulin - name: Generate coverage run: cargo tarpaulin --out Xml - - uses: codecov/codecov-action@v3 + - uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 # v3 with: files: cobertura.xml