💡 Action Version Adoption Cooldown & Supply Chain Quarantine Standard

[github-actions[bot]]

Summary

Enforce a mandatory 7-14 day quarantine period before adopting new GitHub Action or dependency versions, using pinact --min-age, Renovate minimumReleaseAge, or Dependabot's built-in cooldown feature. This catches 80-90% of supply chain attacks by allowing time for malicious versions to be detected and revoked before they enter CI pipelines.

Market Signal

The tj-actions/changed-files supply chain attack (2025) was detected within days. Research shows a 7-14 day adoption delay catches 80-90% of attacks, which typically have detection windows under one week. Three tooling options now support this pattern:

• pinact added --min-age flag for GitHub Actions version quarantine
• Renovate supports minimumReleaseAge with pending/passing status checks during the quarantine window
• Dependabot now has a built-in cooldown feature

71% of organizations never pin actions to SHA — this org already pins, making cooldown the natural next defensive layer. GitHub's own 2026 security roadmap identifies mutable dependencies as a primary attack vector, and adoption cooldowns are the complementary control to SHA pinning.

User Signal

• SonarCloud dependency hardening issues (SonarCloud: GitHub Actions / dependency hardening (×13) #598, SonarCloud: resolve remaining S7635 secrets-inherit stubs (×18) #600) show ongoing supply chain security work
• The org auto-merges Dependabot patch/minor bumps (dependabot-automerge.yml) with no quarantine period, creating a window where a compromised action update could be merged before detection
• Existing dependabot-policy.md and Dependabot configuration templates in standards/dependabot/ are the natural extension points
• Recent merged PRs for S7635 hardening (feat: implement issue #842 — SonarCloud: GitHub Actions / dependency hardening #843, feat: implement issue #875 — [#850] templates drop the S7635 NOSONAR marker on secrets: inherit (dev-lead/add-to-project/auto-rebase/dependabot-automerge) — restore + guard #876-fix: restore S7635 NOSONAR markers on secrets: inherit stubs #882) demonstrate the operational cost of reactive security fixes

Technical Opportunity

The org's existing infrastructure provides clear integration points:

1. Dependabot config — add cooldown settings to the dependabot.yml templates in standards/dependabot/
2. CI status check — a lightweight check that queries the action's release date and goes pending if published within the quarantine window
3. pinact integration — run pinact --min-age 7 in a pre-merge workflow to validate action age
4. Escape hatch — PRs labeled security (already on the exempt-actor list per pr-limits.md) bypass the cooldown for critical patches

The dependabot-policy.md standard would be extended with quarantine requirements, and the compliance audit could flag repos missing cooldown configuration.

Assessment

Dimension	Score	Rationale
Feasibility	high	Tooling exists (pinact, Renovate, Dependabot cooldown). Configuration-only change — no new infrastructure required
Impact	high	Catches 80-90% of supply chain attacks. Closes the gap between SHA pinning (already done) and time-based quarantine (not yet done)
Urgency	high	Supply chain attacks on GitHub Actions are ongoing and increasing. The org's auto-merge pipeline has no quarantine defense today

Adversarial Review

Strongest objection: A 7-14 day delay could slow adoption of legitimate security patches for actions, leaving the org exposed to known vulnerabilities for up to two weeks.

Rebuttal: Security patches for GitHub Actions themselves are rare compared to library CVEs. The escape hatch is clear: PRs labeled security are already on the exempt-actor list (per pr-limits.md) and could bypass the cooldown. Critical action advisories (e.g., GitHub's own advisories) can be force-merged by org-leads. The risk of delayed security patches is far lower than the risk of auto-merging a compromised action version within hours of publication.

Suggested Next Step

Add cooldown configuration to the dependabot.yml templates in standards/dependabot/, update dependabot-policy.md with quarantine requirements, and add a CI check that enforces minimum release age on Dependabot PRs for action updates. Start with a 7-day cooldown and evaluate after one month.