Pin GitHub Actions to commit SHAs - #2613
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The shared setup composite action still executes mutable actions/setup-node@v6 references.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Pins workflow action dependencies to immutable commit SHAs and adds a seven-day Dependabot cooldown.
Changes:
- Pins external actions across 14 workflows.
- Preserves release references in comments.
- Adds the GitHub Actions update cooldown.
File summaries
| File | Description |
|---|---|
.github/dependabot.yaml |
Adds cooldown. |
.github/workflows/codegen-check.yml |
Pins codegen actions. |
.github/workflows/collect-corrections.yml |
Pins collection actions. |
.github/workflows/copilot-setup-steps.yml |
Pins setup actions. |
.github/workflows/corrections-tests.yml |
Pins test actions. |
.github/workflows/docs-validation.yml |
Pins documentation actions. |
.github/workflows/dotnet-sdk-tests.yml |
Pins .NET test actions. |
.github/workflows/go-sdk-tests.yml |
Pins Go test actions. |
.github/workflows/nodejs-sdk-tests.yml |
Pins Node.js test actions. |
.github/workflows/publish.yml |
Pins publishing actions. |
.github/workflows/python-sdk-tests.yml |
Pins Python test actions. |
.github/workflows/rust-sdk-tests.yml |
Pins Rust test actions. |
.github/workflows/sdk-canary.yml |
Pins canary actions. |
.github/workflows/update-copilot-dependency.yml |
Pins dependency-update actions. |
.github/workflows/verify-compiled.yml |
Pins workflow verification checkout. |
Review details
- Files reviewed: 15/15 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…te action Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
SteveSandersonMS
left a comment
SteveSandersonMS
left a comment
There was a problem hiding this comment.
Verified: pins all uses: refs to immutable commit SHAs across CI workflows, with correct SHA resolution spot-checked against the GitHub API, and preserves version comments for Dependabot compatibility. Also pinned the one gap the automated reviewer correctly flagged — .github/actions/setup-copilot/action.yml still had a mutable actions/setup-node@v6 ref in two places — using the same SHA already used elsewhere in this PR for v6. Confirmed no unpinned tag-style refs remain anywhere under .github/, and all 36 workflow/action YAML files still parse. CI-only change, no SDK product code affected.
Pins GitHub Actions
uses:references ingithub/copilot-sdkto immutable commit SHAs.Summary
Why
Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.
Reviewer notes
Pinned refs
.github/workflows/codegen-check.yml:31actions/checkout@v4actions/checkout@11d5960a326750d5838078e36cf38b85af677262tag.github/workflows/codegen-check.yml:33actions/setup-node@v4actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020tag.github/workflows/codegen-check.yml:37actions/setup-go@v5actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1bafftag.github/workflows/codegen-check.yml:43dtolnay/rust-toolchain@stabledtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87branch.github/workflows/codegen-check.yml:54dtolnay/rust-toolchain@masterdtolnay/rust-toolchain@d1031067263f94b142dd6c0ce24c5eb9d02d52a0branch.github/workflows/collect-corrections.yml:29actions/checkout@v4actions/checkout@11d5960a326750d5838078e36cf38b85af677262tag.github/workflows/collect-corrections.yml:30actions/github-script@v8actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cdtag.github/workflows/copilot-setup-steps.yml:28actions/checkout@v6.0.2actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddtag.github/workflows/copilot-setup-steps.yml:32actions/setup-node@v6actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38tag.github/workflows/copilot-setup-steps.yml:43actions/setup-python@v6actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1tag.github/workflows/copilot-setup-steps.yml:49astral-sh/setup-uv@v7astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78tag.github/workflows/copilot-setup-steps.yml:55actions/setup-go@v6actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16tag.github/workflows/copilot-setup-steps.yml:61actions/setup-dotnet@v5actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1tag.github/workflows/copilot-setup-steps.yml:67actions/setup-java@v4actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3tag.github/workflows/copilot-setup-steps.yml:75extractions/setup-just@v3extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9btag.github/workflows/corrections-tests.yml:21actions/checkout@v4actions/checkout@11d5960a326750d5838078e36cf38b85af677262tag.github/workflows/corrections-tests.yml:22actions/setup-node@v4actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020tag.github/workflows/docs-validation.yml:29actions/checkout@v6actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803tag.github/workflows/docs-validation.yml:31actions/setup-node@v6actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38tag.github/workflows/docs-validation.yml:54actions/checkout@v6actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803tag.github/workflows/docs-validation.yml:56actions/setup-node@v6actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38tag.github/workflows/docs-validation.yml:60actions/setup-python@v6actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1tag.github/workflows/docs-validation.yml:65astral-sh/setup-uv@v7astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78tag.github/workflows/docs-validation.yml:87actions/checkout@v6actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803tag.github/workflows/docs-validation.yml:89actions/setup-node@v6actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38tag.github/workflows/docs-validation.yml:93actions/setup-go@v6actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16tag.github/workflows/docs-validation.yml:111actions/checkout@v6actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803tag.github/workflows/docs-validation.yml:113actions/setup-node@v6actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38tag.github/workflows/docs-validation.yml:117actions/setup-dotnet@v5actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1tag.github/workflows/docs-validation.yml:138actions/checkout@v6actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803tag.github/workflows/docs-validation.yml:140actions/setup-node@v6actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38tag.github/workflows/docs-validation.yml:144actions/setup-java@v4actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3tag.github/workflows/dotnet-sdk-tests.yml:21actions/checkout@v6.0.2actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddtag.github/workflows/dotnet-sdk-tests.yml:22actions/setup-dotnet@v5actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1tag.github/workflows/dotnet-sdk-tests.yml:25actions/setup-node@v6actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38tag.github/workflows/dotnet-sdk-tests.yml:195actions/checkout@v6.0.2actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddtag.github/workflows/dotnet-sdk-tests.yml:196actions/setup-dotnet@v5actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1tag.github/workflows/dotnet-sdk-tests.yml:199actions/setup-node@v6actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38tag.github/workflows/dotnet-sdk-tests.yml:366actions/checkout@v6.0.2actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddtag.github/workflows/go-sdk-tests.yml:21actions/checkout@v6.0.2actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddtag.github/workflows/go-sdk-tests.yml:22actions/setup-go@v6actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16tag.github/workflows/go-sdk-tests.yml:35golangci/golangci-lint-action@v9golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278atag.github/workflows/go-sdk-tests.yml:58actions/checkout@v6.0.2actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddtag.github/workflows/go-sdk-tests.yml:61actions/setup-go@v6actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16tag.github/workflows/go-sdk-tests.yml:96actions/checkout@v6.0.2actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddtag.github/workflows/nodejs-sdk-tests.yml:24actions/checkout@v6.0.2actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddtag.github/workflows/nodejs-sdk-tests.yml:25actions/setup-node@v6actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38tag.github/workflows/nodejs-sdk-tests.yml:67actions/checkout@v6.0.2actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddtag.github/workflows/nodejs-sdk-tests.yml:68actions/setup-node@v6actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38tag.github/workflows/nodejs-sdk-tests.yml:112actions/checkout@v6.0.2actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83ddtag...and 59 more omitted from this PR body.
Dependabot
cooldown: default-days: 7) to the existinggithub-actionsDependabot configuration.Warnings
.github/workflows/codegen-check.yml:43dtolnay/rust-toolchain@stable.github/workflows/codegen-check.yml:54dtolnay/rust-toolchain@master.github/workflows/publish.yml:310dtolnay/rust-toolchain@stable.github/workflows/publish.yml:377pypa/gh-action-pypi-publish@release/v1.github/workflows/rust-sdk-tests.yml:36dtolnay/rust-toolchain@stable.github/workflows/rust-sdk-tests.yml:296dtolnay/rust-toolchain@stable.github/workflows/update-copilot-dependency.yml:48dtolnay/rust-toolchain@stable.github/workflows/update-copilot-dependency.yml:54dtolnay/rust-toolchain@masterGenerated by pinner 0.1.0.