chore: pin actions with commit sha #111
Merged
+17
−17
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
|
ReenigneArcher
changed the title
Member
|
@AndyScherzinger thank you for the PR. If possible, could you sign the CLA? #111 (comment) I have been slowly converting actions to use pinned SHAs throughout our organization; however I have not been pinning official GitHub actions because I didn't want to be inundated with dependabot updates... but actually looking at the tags on these actions they are not providing patches as often as I originally thought so I think it's okay to pin them as well. Thank you for sharing the |
Contributor
Author
|
Hi @ReenigneArcher yes of course, just signed it now 👍 Happy you found the info about the pinact tool helpful. Another tool you might find helpful as well would be zizmor if not already know it. We use to scan our actions for security aspects and it can do |
❌ 15 Tests Failed:
View the top 3 failed test(s) by shortest run time
To view more test analytics, go to the Test Analytics Dashboard |
Member
|
Some of these tests are going to fail because forks don't have the correct permisisons, but could you fix the lint issues? https://github.com/LizardByte/actions/actions/runs/21479952136/job/61890314933?pr=111 Basically need 2 spaces before the version tag comment. |
This was referenced Jan 29, 2026
Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
AndyScherzinger
force-pushed
the
pinning-actions
branch
from
1b6e28a to
ee40b0a
Compare
|
Contributor
Author
Done ✅ |
Contributor
Author
|
While not wanting to misuse the PR as a forum, but since you added pinact and zizmor to your roadmap and I've just seen the check for a semantic PR title (sorry for missing that) you might also be interest in a check like https://github.com/nextcloud/.github/blob/master/workflow-templates/block-unconventional-commits.yml for ensuring commit messages are following the same logic by having to be following conventional commit standards in case you rcurrent action is limited to PR titles. |
Member
No worries at all. This is a good discussion!
I squash and merge as many PRs just get really messy with commits. Then the new commit gets the PR title as the commit message. I use https://github.com/marketplace/semantic-prs to validate it, which is a free service for public repos and doesn't use any runner. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
First of all thanks a lot for your work in providing these actions, we at Nextcloud happily use them to execute our CalDav/CardDav tests in combination with Apple' s test data but they now break when using Github's newly introduced action-pinning enforcement setting for a repo/org, see below.
For security reasons Github introduced the ability to enforce action pinning based on commit SHAs, see repo settings screenshot below
So if you currently use the LizardByte actions, or the setup-python one respectively you will be greeted with the following error:
...because Github is now blocking the execution of the action.
This PR fixes any occurrence it can by using a pinning tool, see https://github.com/suzuki-shunsuke/pinact?tab=readme-ov-file#how-to-use for details if interested, command is
pinact runexecuted on a repo root folder-level.Some issues remain (unpinned actions) due to the nature of their version I suppose:
Yet I only expect the last item to be an issue that keeps blocking the use of the action in pinning-enforced projects on Github.
Screenshot
Issues Fixed or Closed
Roadmap Issues
Type of Change
Checklist
AI Usage