From 2c7f0a23d19e766e24db005a36bf4a5de7a6b790 Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Thu, 10 Sep 2026 17:33:37 +0200 Subject: [PATCH] ci(actions): pin the third-party actions to commit SHAs CodeQL flagged docker/setup-buildx-action, docker/login-action, docker/build-push-action and cypress-io/github-action as unpinned: a moving v3 or v6 tag lets whoever controls it change what runs with the workflow's GHCR write token. Each action is now pinned to the commit its tag points to today, with the exact release as a trailing comment (v3.12.0, v3.7.0, v6.19.2, v6.10.9), resolved through the GitHub API, so the code that runs does not change. GitHub's own actions/* were not flagged and keep their tags. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 6 +++--- .github/workflows/tests.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 37adf13..96bd9fa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -70,11 +70,11 @@ jobs: - name: Set up Docker Buildx if: steps.semver.outputs.found == 'true' - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Login to GHCR if: steps.semver.outputs.found == 'true' - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -82,7 +82,7 @@ jobs: - name: Build and publish image if: steps.semver.outputs.found == 'true' - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: context: . file: ./Dockerfile diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index bb4a96d..699cae2 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -190,7 +190,7 @@ jobs: xvfb - name: Run Cypress tests - uses: cypress-io/github-action@v6 + uses: cypress-io/github-action@f790eee7a50d9505912f50c2095510be7de06aa7 # v6.10.9 with: working-directory: app install: false