_⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_

[jackgranatowski]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/publish-dist.yml"
echo "== File: $FILE =="
if [ -f "$FILE" ]; then
  nl -ba "$FILE" | sed -n '1,160p'
else
  echo "Missing $FILE"
fi

echo
echo "== Extract uses: lines =="
rg -n '^\s*uses:\s*actions/(checkout|setup-node)@' .github/workflows/publish-dist.yml || true

Repository: codeslash-dev/SLASHED

Length of output: 173

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/publish-dist.yml"
echo "== File: $FILE =="

if [ -f "$FILE" ]; then
  # Print with line numbers without relying on `nl`
  awk '{printf "%5d\t%s\n", NR, $0}' "$FILE" | sed -n '1,220p'
else
  echo "Missing $FILE"
fi

echo
echo "== Extract uses: lines =="
rg -n '^\s*uses:\s*actions/(checkout|setup-node)@' "$FILE" || true

Repository: codeslash-dev/SLASHED

Length of output: 3307

---

Pin GitHub Actions to immutable SHAs.

.github/workflows/publish-dist.yml uses mutable tags:

• uses: actions/checkout@v4 (line 34)
• uses: actions/setup-node@v4 (line 39)

Suggested fix

-      - name: Checkout main
-        uses: actions/checkout@v4
+      - name: Checkout main
+        uses: actions/checkout@<full-length-commit-sha> # actions/checkout v4.x

-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup Node
+        uses: actions/setup-node@<full-length-commit-sha> # actions/setup-node v4.x

🧰 Tools

🪛 zizmor (1.25.2)

[error] 34-34: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-dist.yml at line 34, Replace the mutable action
tags with immutable commit SHAs: locate the two occurrences "uses:
actions/checkout@v4" and "uses: actions/setup-node@v4" and change them to the
corresponding pinned SHAs (e.g., "uses: actions/checkout@<commit-sha>" and
"uses: actions/setup-node@<commit-sha>") by copying the latest stable commit SHA
from each action's GitHub repository (or marketplace) and updating the workflow;
commit the change and verify the workflow runs successfully.

Originally posted by @coderabbitai in #66 (comment)