Compliance Category: Action SHA Pinning (3 findings)

[don-petry]

Compliance Category: Action SHA Pinning (3 findings)

Category: action-sha-pinning
Severity: error
Affected repos: .github-private (1 repo)

Summary

Three workflow files in .github-private use unpinned GitHub Actions instead of pinning to SHAs. Actions must be pinned to specific commits for security and reproducibility.

Affected Checks

Workflow	Finding
daily-pr-review-health.yml	unpinned-actions-daily-pr-review-health.yml
repair-pr-approvals.yml	unpinned-actions-repair-pr-approvals.yml
test.yml	unpinned-actions-test.yml

Remediation

Update each workflow file to pin all action references to specific commit SHAs instead of branch names (e.g., actions/checkout@e7e0efcc... instead of actions/checkout@main).

Reference: GitHub Actions Security - Pin to SHA

---

This issue was automatically created by the compliance audit and groups 3 action SHA pinning findings in .github-private.

[don-petry]

Implementation Plan

Pin all GitHub Actions to commit SHAs in workflows:

Actions to pin:

• In repair-pr-approvals.yml (line 21): actions/checkout@v6.0.2 → actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
• In test.yml (line 16): actions/checkout@v6.0.2 → actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
• In daily-pr-review-health.yml (line 45): actions/cache@v5.0.5 → actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f0 # v5.0.5

Reference: Latest SHA mappings should be verified from the official action repositories or use gh api repos/actions/<action>/releases/latest.

[don-petry]

Resolved! This check is now passing as of 2026-05-29. Closing automatically.