Skip to content

🩹 [Patch]: Use commit SHA with specific version comments for all workflow action references #238

@MariusStorhaug

Description

@MariusStorhaug

Describe the change

Standardize all GitHub Actions workflow references in this repository so that every action uses a commit SHA, with a comment specifying the most specific version tag (e.g., # v1.2.3).

Why:

  • Ensures deterministic builds and protects against unexpected updates or supply chain attacks.
  • Improves maintainability and readability by documenting the exact version in use.

Examples:
✅ Correct:

  - name: Checkout Code
    uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v1.2.3
    with:
      persist-credentials: false

❌ Incorrect:

  - name: Checkout Code
    uses: actions/checkout@v1

Scope of change:

  • Update all workflow files in .github/workflows/*. yml to reference actions by SHA with a version comment, instead of by tag.
  • Use the most specific version tag in comments (e.g., v1.2.3 instead of v1).
  • Affected actions may include but are not limited to: actions/checkout, actions/download-artifact, actions/upload-artifact, actions/configure-pages, actions/deploy-pages, custom PSModule actions, etc.
  • Ensure CI and linting checks do not break.
  • Document changes in affected files.

Security Note:
Dependabot is configured to notify and create PRs when upstream actions/workflows update. Dependabot supports SHA references, so using them does not reduce security or update capabilities.

Acceptance:

  • All workflows use commit SHA with a version comment specifying the most specific tag
  • No workflows reference actions by tag (e.g., @v1)
  • All CI/CD checks pass
  • Documentation is updated as needed

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions