Skip to content

Pin GitHub Actions to exact release commit SHAs - #338

Closed
lpmi-13 wants to merge 1 commit into
fabio-rovai:mainfrom
lpmi-13:pin-github-actions-shas
Closed

lpmi-13 wants to merge 1 commit into
fabio-rovai:mainfrom
lpmi-13:pin-github-actions-shas

Conversation

@lpmi-13

@lpmi-13 lpmi-13 commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

Resolve existing mutable action tags to their current release commits and document exact patch versions inline. Keep rust-toolchain on stable.

Resolve existing mutable action tags to their current release commits and document exact patch versions inline. Keep rust-toolchain on stable.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@fabio-rovai

Copy link
Copy Markdown
Owner

Thanks, this landed in #342. Two of the pins named commits that do not exist: actions/setup-java@7f4fc3e2 ("v4.9.1") and actions/setup-python@b6effb05 ("v5.7.0", which is not a release; the newest v5 is v5.6.0). The commits API answers 422 for both, so every job using them would have failed to resolve the action. They now pin cf277c60 (setup-java v4.9.1) and a26af69b (setup-python v5.6.0), and all 17 pins were re-resolved against their tags.

@lpmi-13

lpmi-13 commented Oct 28, 2026

Copy link
Copy Markdown
Contributor Author

Oh wow, Ive never seen copilot make mistakes like that...I'll be sure to double check those commits myself next time. Thanks for flagging it!

GQAdonis pushed a commit to GQAdonis/open-ontologies that referenced this pull request Oct 29, 2026
fabio-rovai#338 pinned actions/setup-java to 7f4fc3e2 ("v4.9.1") and
actions/setup-python to b6effb05 ("v5.7.0"). Neither commit exists in its
repository (the commits API answers 422 "No commit found"), and setup-python
has no v5.7.0: its newest v5 release is v5.6.0. Every job using either action
would fail to resolve it. They now pin the commits the tags point at:
setup-java v4.9.1 = cf277c60, setup-python v5.6.0 = a26af69b (also what @v5
resolves to today, so behaviour is unchanged).

All 17 pinned actions in .github/workflows were re-resolved against their
tags with the GitHub API: 17/17 match. actionlint clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants