Ci: SHA-pin GitHub Actions versions 0.0.45#83
Merged
Conversation
Closes the iter22 deferred MEDIUM (mutable action tags). Replaces the 6 'uses: owner/repo@vN' references in ci.yml with the specific commit SHA each tag currently resolves to: - actions/checkout: v4 -> 34e114876b... (v4.3.1) - actions/setup-python: v5 -> a26af69be9... (v5.6.0) - astral-sh/setup-uv: v3 -> caf0cab7a6... (v3.2.4) The major-version contract is preserved via inline comments so the human-readable intent (matrix supports each major) stays visible. A future tag force-push or upstream account compromise can no longer substitute malicious code into the CI runner — the SHA is content-addressed and immutable. Recommended renewal cadence: re-pin to the latest patch SHA within each major every 6-12 months via Renovate, Dependabot, or pinact. iter23 does this manually as a one-shot baseline. CI run on this branch is the live verification — the workflow must still complete green with the SHA pins in place.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the iter22 deferred MEDIUM (mutable action tags). The 6
uses: owner/repo@vNreferences inci.ymlare now pinned tothe specific commit SHA each tag currently resolves to.
Changes
actions/checkout@v4@34e114876b... # v4.3.1actions/setup-python@v5@a26af69be9... # v5.6.0astral-sh/setup-uv@v3@caf0cab7a6... # v3.2.4The major-version intent is preserved via the inline comment so
maintainers can see at a glance which patch each pin represents.
Why
A future tag force-push or upstream account compromise can no
longer substitute malicious code into the CI runner. The SHA is
content-addressed and immutable; the runner downloads exactly the
artifact this PR was reviewed against.
How to Test
The PR push itself is the test — both jobs (unit-tests matrix +
packaging-gate) should run green with the SHA pins. iter22's
concurrencygroup +permissions: contents: readcarryover unchanged.
Renewal Cadence
Re-pin to the latest patch SHA within each major every 6-12 months
via Renovate / Dependabot / pinact. iter23 does this manually as
a one-shot baseline.
Checklist
Testing
Compatibility
4-file version bump.
matrix, same uv install path, same test invocation.
Documentation