🔒 Pin GitHub Actions to commit SHAs by paulinebm · Pull Request #2004 · huggingface/tokenizers

paulinebm · 2026-04-02T12:21:37Z

🔒 Pin GitHub Actions to commit SHAs

This PR pins all GitHub Actions to their exact commit SHA instead of mutable tags or branch names.

Why?
Pinning to a SHA prevents supply chain attacks where a tag (e.g. v4) could be moved to point to malicious code.

Changes

Workflow	Action	Avant	Après	SHA
`CI.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`CI.yml`	`actions/setup-python`	`v5`	`v5`	`a26af69be951…`
`CI.yml`	`PyO3/maturin-action`	`v1`	`v1`	`04ac600d27cd…`
`CI.yml`	`actions/upload-artifact`	`v4`	`v4`	`ea165f8d65b6…`
`CI.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`CI.yml`	`actions/setup-python`	`v5`	`v5`	`a26af69be951…`
`CI.yml`	`PyO3/maturin-action`	`v1`	`v1`	`04ac600d27cd…`
`CI.yml`	`actions/upload-artifact`	`v4`	`v4`	`ea165f8d65b6…`
`CI.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`CI.yml`	`actions/setup-python`	`v5`	`v5`	`a26af69be951…`
`CI.yml`	`PyO3/maturin-action`	`v1`	`v1`	`04ac600d27cd…`
`CI.yml`	`actions/upload-artifact`	`v4`	`v4`	`ea165f8d65b6…`
`CI.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`CI.yml`	`actions/setup-python`	`v5`	`v5`	`a26af69be951…`
`CI.yml`	`PyO3/maturin-action`	`v1`	`v1`	`04ac600d27cd…`
`CI.yml`	`actions/upload-artifact`	`v4`	`v4`	`ea165f8d65b6…`
`CI.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`CI.yml`	`PyO3/maturin-action`	`v1`	`v1`	`04ac600d27cd…`
`CI.yml`	`actions/upload-artifact`	`v4`	`v4`	`ea165f8d65b6…`
`CI.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`CI.yml`	`actions/attest-build-provenance`	`v1`	`v1`	`ef244123eb79…`
`CI.yml`	`PyO3/maturin-action`	`v1`	`v1`	`04ac600d27cd…`
`node.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`node.yml`	`dtolnay/rust-toolchain`	`stable`	`stable`	`29eef336d9b2…`
`node.yml`	`actions/cache`	`v4`	`v4`	`0057852bfaa8…`
`node.yml`	`actions/setup-node`	`v4`	`v4`	`49933ea5288c…`
`node.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`node.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`python.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`python.yml`	`actions-rs/toolchain`	`v1`	`v1`	`16499b5e05bf…`
`python.yml`	`actions/setup-python`	`v5`	`v5`	`a26af69be951…`
`python.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`python.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`python.yml`	`actions-rs/toolchain`	`v1`	`v1`	`16499b5e05bf…`
`python.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`python.yml`	`actions/setup-python`	`v5`	`v5`	`a26af69be951…`
`python.yml`	`actions/cache`	`v4`	`v4`	`0057852bfaa8…`
`python.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`python.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`python.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`node-release.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`node-release.yml`	`dtolnay/rust-toolchain`	`stable`	`stable`	`29eef336d9b2…`
`node-release.yml`	`actions/cache`	`v4`	`v4`	`0057852bfaa8…`
`node-release.yml`	`actions/setup-node`	`v4`	`v4`	`49933ea5288c…`
`node-release.yml`	`actions/setup-python`	`v5`	`v5`	`a26af69be951…`
`node-release.yml`	`actions/upload-artifact`	`v4`	`v4`	`ea165f8d65b6…`
`node-release.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`node-release.yml`	`actions/setup-node`	`v4`	`v4`	`49933ea5288c…`
`node-release.yml`	`actions/download-artifact`	`v4`	`v4`	`d3f86a106a0b…`
`docs-check.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`docs-check.yml`	`actions/setup-python`	`v5`	`v5`	`a26af69be951…`
`docs-check.yml`	`dtolnay/rust-toolchain`	`stable`	`stable`	`29eef336d9b2…`
`docs-check.yml`	`actions/upload-artifact`	`v4`	`v4`	`ea165f8d65b6…`
`build_documentation.yml`	`huggingface/doc-builder/.github/workflows/build_main_documentation.yml`	`main`	`main`	`90b4ee2c10b8…`
`build_pr_documentation.yml`	`huggingface/doc-builder/.github/workflows/build_pr_documentation.yml`	`main`	`main`	`90b4ee2c10b8…`
`delete_doc_comment.yml`	`huggingface/doc-builder/.github/workflows/delete_doc_comment.yml`	`main`	`main`	`90b4ee2c10b8…`
`delete_doc_comment_trigger.yml`	`huggingface/doc-builder/.github/workflows/delete_doc_comment_trigger.yml`	`main`	`main`	`90b4ee2c10b8…`
`upload_pr_documentation.yml`	`huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml`	`main`	`main`	`90b4ee2c10b8…`
`rust.yml`	`actions/checkout`	`v4`	`v6.0.2`	`de0fac2e4500…`
`rust.yml`	`actions-rs/toolchain`	`v1`	`v1`	`16499b5e05bf…`
`rust.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`rust.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`rust.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`rust.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`rust.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`rust.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`rust.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`rust.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`rust.yml`	`actions-rs/cargo`	`v1`	`v1`	`844f36862e91…`
`rust.yml`	`obi1kenobi/cargo-semver-checks-action`	`v2`	`v2`	`5b298c9520f7…`

🤖 Generated by /github-actions-audit — [security/pin-actions-to-sha]

Closes huggingface/tracking-issues#280

HuggingFaceDocBuilderDev · 2026-04-02T12:24:39Z

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

ArthurZucker

we just merged a workflow can you update it as well please? 🤗

paulinebm added 11 commits April 2, 2026 14:21

🔒 pin CI.yml actions to commit SHAs

9846736

🔒 pin node.yml actions to commit SHAs

14b6e15

🔒 pin python.yml actions to commit SHAs

2ff7bdd

🔒 pin node-release.yml actions to commit SHAs

84ab617

🔒 pin docs-check.yml actions to commit SHAs

ac40812

🔒 pin build_documentation.yml actions to commit SHAs

ccd74d8

🔒 pin build_pr_documentation.yml actions to commit SHAs

57d0cef

🔒 pin delete_doc_comment.yml actions to commit SHAs

cdd44de

🔒 pin delete_doc_comment_trigger.yml actions to commit SHAs

a7cbf1f

🔒 pin upload_pr_documentation.yml actions to commit SHAs

1c03488

🔒 pin rust.yml actions to commit SHAs

788a9cf

ArthurZucker approved these changes Apr 2, 2026

View reviewed changes

🔒 merge main + re-pin node-release.yml actions to SHAs

97508a7

paulinebm merged commit 307cb55 into main Apr 2, 2026
1 check passed

paulinebm deleted the security/pin-actions-to-sha branch April 2, 2026 14:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🔒 Pin GitHub Actions to commit SHAs#2004

🔒 Pin GitHub Actions to commit SHAs#2004
paulinebm merged 12 commits intomainfrom
security/pin-actions-to-sha

paulinebm commented Apr 2, 2026

Uh oh!

HuggingFaceDocBuilderDev commented Apr 2, 2026

Uh oh!

ArthurZucker left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

paulinebm commented Apr 2, 2026