-
Notifications
You must be signed in to change notification settings - Fork 0
Labels
Description
Describe the change
Standardize all GitHub Actions workflow references in this repository so that every action uses a commit SHA, with a comment specifying the most specific version tag (e.g., # v1.2.3).
Why:
- Ensures deterministic builds and protects against unexpected updates or supply chain attacks.
- Improves maintainability and readability by documenting the exact version in use.
Examples:
✅ Correct:
- name: Checkout Code
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v1.2.3
with:
persist-credentials: false❌ Incorrect:
- name: Checkout Code
uses: actions/checkout@v1Scope of change:
- Update all workflow files in
.github/workflows/*. ymlto reference actions by SHA with a version comment, instead of by tag. - Use the most specific version tag in comments (e.g.,
v1.2.3instead ofv1). - Affected actions may include but are not limited to:
actions/checkout,actions/download-artifact,actions/upload-artifact,actions/configure-pages,actions/deploy-pages, custom PSModule actions, etc. - Ensure CI and linting checks do not break.
- Document changes in affected files.
Security Note:
Dependabot is configured to notify and create PRs when upstream actions/workflows update. Dependabot supports SHA references, so using them does not reduce security or update capabilities.
Acceptance:
- All workflows use commit SHA with a version comment specifying the most specific tag
- No workflows reference actions by tag (e.g.,
@v1) - All CI/CD checks pass
- Documentation is updated as needed
Copilot