ci: enforce the action pinning rules in the shared hygiene workflow - #3
Merged
Conversation
ADR-0012 settled two pinning rules and nothing ever checked either one. ADR-0021 then found three repositories doing two different things, which is what an unenforced rule looks like after a few months. The `action pins` step encodes both rules exactly: anything outside beatrax-app/ needs a full 40-character SHA, and a first-party reusable workflow needs its major-version tag. Local composite actions are exempt — they carry no supply-chain risk of their own. It lives in `hygiene` so every repository that already calls the shared workflow picks it up without adding a job name to its ruleset. Spec: GOV-R12 Signed-off-by: Wessel Verheij <info@nightworks.io>
github-actions
Bot
added
documentation
|
lessevv
added a commit
to beatrax-app/beatrax
that referenced
this pull request
Jul 27, 2026
Sonar wants a full commit SHA on every `uses:`. ADR-0021 puts first-party reusable workflows on a moving major-version tag instead, so the rule reports thirteen findings that are the decision rather than a defect, and the quality gate fails on a C security rating. Disabling the rule drops its third-party half too, and that half is the one that matters — so the shared hygiene workflow now carries an `action pins` step enforcing both halves precisely (beatrax-app/spec#3). It is stricter than S7637 about the case S7637 was right about. Spec: GOV-R12 Signed-off-by: Wessel Verheij <info@nightworks.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ADR-0012 settled two pinning rules and nothing ever checked either one. ADR-0021 then found three repositories doing two different things — which is what an unenforced rule looks like after a few months.
The new
action pinsstep inhygieneencodes both rules exactly:beatrax-app/must be a full 40-character commit SHA (ADR-0012 rule 1)./…) are exempt — no supply-chain risk of their ownIt sits in the existing
actionlintjob, so no repository has to add a job name to its ruleset to gain it.Verified against all four repositories (all pass) and against a fixture containing both violation classes (fails with the offending file:line).
Spec: GOV-R12