Repository navigation
fix: pin nested actions by commit SHA - #155
Merged
ivanmilevtues merged 1 commit intoOct 25, 2026
Merged
Conversation
Repositories can require actions to be pinned to a full-length commit SHA. GitHub enforces that on the actions used by a composite action as well, so the tag references in `action.yml` made the action fail at startup, with a bare `startup_failure`, for every adopter with that policy enabled. Pin all five actions that `action.yml` uses to the commit their current moving tag or branch resolves to, with the exact release as a comment. This does not change which code runs. Add a test that rejects any non-local `uses:` in `action.yml` that is not pinned to a full SHA.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Svilen-Stefanov
approved these changes
Oct 25, 2026
Svilen-Stefanov
left a comment
Svilen-Stefanov
left a comment
Contributor
There was a problem hiding this comment.
Thanks @Stephan202! I double checked all the SHAs against the upstream tags and they all match, so nothing changes at runtime 👍 The pinning test is a good guard too, especially the check that the regex matches anything at all.
I'll add a dependabot config to get notified when things change and keep them up to date.
ivanmilevtues
approved these changes
Oct 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
action.ymluses five third-party actions by mutable tag or branch. This is notcompatible with GitHub's "Require actions to be pinned to a full-length commit
SHA" policy, which is also enforced on the actions that a composite action uses:
adopters with that policy enabled cannot use this action, even if they pin the
action itself. Pinning by commit SHA is also a general best practice, as a
mutable tag can be moved to different code after it has been reviewed.
Change
uses:references inaction.ymlto a full commit SHA, with therelease as a trailing comment.
tests/test_action_pinning.py, which fails if a non-localuses:inaction.ymlis not pinned to a 40-character SHA.Each SHA is the commit that the current moving ref resolves to (checked on
2026-10-25), so the code that runs is unchanged:
actions/checkoutv411d5960a326750d5838078e36cf38b85af677262(v4.4.0)actions/setup-javav5b6effb05e454b25005698d916606bdc6ffcbf961(v5.7.0)actions/setup-pythonv5a26af69be951a213d495a4c3e4e4022e16d87065(v5.6.0)actions/upload-artifactv4ea165f8d65b6e75b540449e92b4886f43607fa02(v4.6.2)marocchino/sticky-pull-request-commentv2(branch)773744901bac0e8cbb5a0dc842800d45e9b2b405(v2.9.4)Verification
The new test fails on
mainand passes with this change. The existing suitepasses (
python -m unittest discover -s tests: 259 tests, 7 skipped).Notes
action.ymlis changed, as it is the file adopters execute. Therepository's own workflows also use tag references; I can pin those in a
follow-up.
I have not added either here.
AI disclosure
This change was written using Claude Sonnet 5.5 with high effort.