Skip to content

CI: pin third-party GitHub Actions to commit SHAs - #3381

Merged
goastler merged 1 commit into
mainfrom
sec/ci-pin-third-party-actions
Sep 29, 2026
Merged

CI: pin third-party GitHub Actions to commit SHAs#3381
goastler merged 1 commit into
mainfrom
sec/ci-pin-third-party-actions

Conversation

@goastler

@goastler goastler commented Sep 25, 2026

Copy link
Copy Markdown
Member

What changed

  • Every third-party action (the GitHub App token action, docker login/buildx/build-push, create-pull-request, Android setup) is pinned to a commit SHA. The tag is kept as a comment.

Why

  • Tags can be moved. Whoever controls a tag could run code with our GitHub App private key and Docker Hub credentials. We already pin our own actions this way.

Effect

  • Actions only change when we bump the SHA.

Tests

  • A grep for unpinned third-party uses: lines finds some on main and none now.

@goastler
goastler marked this pull request as ready for review September 29, 2026 02:07
@goastler
goastler merged commit 657967e into main Sep 29, 2026
17 of 20 checks passed
@goastler
goastler deleted the sec/ci-pin-third-party-actions branch September 29, 2026 02:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@forgetso forgetso Awaiting requested review from forgetso forgetso is a code owner
@HughParry HughParry Awaiting requested review from HughParry HughParry is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@goastler