🔒️(ci) pin all actions and installs against supply-chain tampering

[providenz]

Purpose

CI workflows resolved most of their actions, container images and installed packages through mutable references (branch names, floating tags, unversioned package names). Anyone able to move one of those references could run arbitrary code inside our pipelines, with a write-capable token available in the workspace.
This narrows both the code that CI executes and what that code can reach.

Proposal

• Resolve every third-party action to an immutable commit, keeping the human redable version alongside it as a comment
• Pin the container images and downloaded binaries used by the test jobs, and verify the download against a known checksum
• Pin the versions of packages installed during linting jobs
• Default every workflow to read-only repository access, leaving the 2 jobs that really needs to write with their existing elevated scope
• Stop the checkout step from leaving a usable credential in the workspace, since no job pushes through it
• Make lockfile enforcement the default for package installs rather than relying on each call site passing the flag
• Add automated weekly updates so the pinned references do not go stale

[coderabbitai]

Warning

Review limit reached

@providenz, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 57 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fe6af254-e624-4caf-874b-d6df8da33f81

📥 Commits

Reviewing files that changed from the base of the PR and between 4086ab9 and 251fee6.

📒 Files selected for processing (11)

• .github/workflows/conversations-frontend.yml
• .github/workflows/conversations.yml
• .github/workflows/crowdin_download.yml
• .github/workflows/crowdin_upload.yml
• .github/workflows/dependencies.yml
• .github/workflows/docker-hub.yml
• .github/workflows/helmfile-linter.yaml
• .github/workflows/release-helm-chart.yaml
• CHANGELOG.md
• src/frontend/.yarnrc
• src/mail/.yarnrc

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch providenz/harden-ci

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE