ci: pin GitHub Actions to commit SHAs (supply-chain hardening)

[Fabridev444]

What

Pins all 4 unpinned action references across debian-ci.yml and docker-publish.yml to immutable commit SHAs, preserving the original tag as a trailing # v2 comment so Dependabot keeps auto-bumping the SHA on new releases.

-      - uses: actions/checkout@v2
-      - uses: sigstore/cosign-installer@main
-      - uses: docker/metadata-action@v3.6.2
+      - uses: actions/checkout@ee0669b... # v2
+      - uses: sigstore/cosign-installer@6f9f177... # main
+      - uses: docker/metadata-action@e562237... # v3.6.2

Why this matters for pgloader specifically

docker-publish.yml is the most exposed surface here. It runs on pushes/releases and uses sigstore/cosign-installer@main — a branch ref, not a tag. Anyone with push access to sigstore/cosign-installer can rewrite main and tamper with the cosign binary that signs the published dimitri/pgloader docker images. If that happens, every downstream consumer that pulls a freshly built image after the rewrite gets a signature created by an attacker-controlled cosign — pulled by docker pull dimitri/pgloader:latest minutes later by every CI pipeline using pgloader for migrations.

Pinning to a commit SHA closes that path: SHAs cannot be rewritten without a force-push that breaks every downstream pin simultaneously, which CI surfaces immediately.

For background: tj-actions/changed-files CVE-2025-30066 was exactly this attack class on a tag-pinned action.

This is the GitHub Actions security guide and OpenSSF Scorecard Pinned-Dependencies baseline recommendation.

How

Generated mechanically with gha-shield v1.0.6:

npx Fabridev444/gha-shield .github/workflows --fix

Compatibility

• ✅ Idempotent — re-running does nothing.
• ✅ Dependabot reads the # v2 trailing comments and auto-bumps SHAs.
• ✅ Zero behavior change.

Other PRs in the same series

• DNSCrypt/dnscrypt-proxy#3231 — 11 pins
• node-schedule/node-schedule#759 — 10 pins
• anza-xyz/wallet-adapter#1154 — 10 pins

---

gha-shield is MIT and self-hosted via npx Fabridev444/gha-shield. Tip jar (Solana / USDC SPL, scannable QR + Solana Pay link): https://fabridev444.github.io/gha-shield/ · wallet 634UtV9dWq8G7ciosqx1pcKkBK4kNkNod9yvoM8ujSdM.