chore: Pin third-party GitHub Actions to commit SHAs#18872
Merged
Conversation
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
hudi-agent
reviewed
May 28, 2026
Contributor
hudi-agent
left a comment
hudi-agent
left a comment
There was a problem hiding this comment.
🤖 This review was generated by an AI agent and may contain mistakes. Please verify any suggestions before applying.
No reviewable code files in this PR.
cc @yihua
Collaborator
yihua
approved these changes
May 28, 2026
Contributor
yihua
left a comment
yihua
left a comment
There was a problem hiding this comment.
LGTM. @arpitjain099 Thanks for the fix! Could you fix the PR title and description to be compliant?
arpitjain099
changed the title
Contributor
Author
|
Thanks @yihua! Updated the title to the |
voonhous
changed the title
yihua
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Describe the issue this Pull Request addresses
Pins third-party GitHub Actions that were referenced by mutable tags to full commit SHAs in the affected workflow(s).
Summary and Changelog
A mutable tag can be repointed by the upstream owner, or by an attacker who compromises the action's repository, to arbitrary code that then runs in CI with the workflow's token and secrets. That is the failure mode behind CVE-2025-30066 (the tj-actions/changed-files compromise). Pinning to an immutable commit SHA makes the referenced code deterministic. GitHub-maintained
actions/*were left on their existing refs.Impact
CI/build hardening only. No public API, runtime behavior, or user-facing change. Each pinned SHA corresponds to the same release the tag pointed to, so workflow behavior is unchanged.
Risk Level
none
Documentation Update
N/A
Contributor's checklist