ci: arm the action-pin gate — findings fail, not just report (backend#1492) - #471
Merged
Conversation
…#1492) The pinning work is done: 415 mutable action refs across the fleet on 2026-08-04, zero on every develop branch today (#1490, #1491 closed with that scan). This makes it stay done. action-pins has been running here since it reached main, but in soft-fail: it reports a violation and lets the PR merge anyway. That is the state hand-pinning already proved insufficient. While #1446 was open to pin one action, #1449 added a SECOND unpinned call site of the SAME action in a non-overlapping hunk of the same file. Both merged cleanly, git reported no conflict because there was none, and it was caught by a human reading the diff rather than by any gate. That incident is why #1492 exists. Arming imports no backlog. Measured immediately before this change, across all 15 develop branches carrying this caller: ZERO pin violations. So this flips a check that is already green into one that stays green. What it enforces, per D10: third-party and actions/* refs pinned to a full 40-character commit SHA with a trailing exact-version comment; tracebloc/* refs pinned to @main (Q3). A floating tag can be repointed by its owner at any commit, which is the supply-chain risk the whole class exists to remove. The .github repo armed this first and for a specific reason: it publishes these workflows to every other repo, so its own refs are inherited fleet-wide (.github#178, backend#1603).
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6c6e616. Configure here.
…puts My first commit anchored on the bare key `all-files:`, which matched its FIRST occurrence in the file - the workflow_dispatch INPUT DEFINITION, not the code-quality call's `with:` map. So `action-pins: true` landed as an invalid input declaration (inputs need description/type), the workflow failed to load, and code-quality did not run at all on this PR. Measured: 10 of 15 callers hit this; the 5 that did not are the ones whose first `all-files:` happens to be in `with:`. Now anchored on the `with:` that follows the code-quality `uses:` line, so the insertion point is structural rather than a name that appears twice. Validated by parsing the result: action-pins present in jobs.quality.with, absent from workflow_dispatch.inputs. Also restores the trailing newline the first commit stripped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Arms
action-pinsso a mutable action ref fails the PR instead of merely reporting. This is backend#1492.Why now
The pinning work is complete — 415 mutable refs fleet-wide on 2026-08-04, zero on every develop branch today (#1490 and #1491 closed today with that scan). This is the part that makes it stay done.
action-pinshas been running here in soft-fail since it reachedmain: it reports a violation and lets the PR merge anyway. That is exactly the state hand-pinning already proved insufficient — while #1446 was open to pin one action, #1449 added a second unpinned call site of the same action in a non-overlapping hunk of the same file. Both merged cleanly, git reported no conflict because there was none, and a human reading the diff caught it. No gate did.Arming imports no backlog
Measured immediately before opening this, across all 15 develop branches carrying this caller:
So this flips a check that is already green into one that stays green. Expect
quality / action-pinsgreen on this PR.What it enforces (D10)
Third-party and
actions/*refs pinned to a full 40-character commit SHA with a trailing exact-version comment;tracebloc/*refs pinned to@main(Q3). A floating tag can be repointed by its owner at any commit — that is the supply-chain risk this removes..githubarmed this first, because it publishes these workflows to every other repo and its refs are inherited fleet-wide (.github#178, backend#1603).Parent backend#1405.
Note
Low Risk
CI-only workflow input change with no runtime or application code impact; intended to block new unpinned actions after a zero-violation baseline.
Overview
Arms the shared code-quality workflow’s action-pin check so unpinned/mutable GitHub Action refs fail the job instead of only reporting while the PR can still merge.
The caller now passes
action-pins: trueandaction-pins-soft-fail: falseintotracebloc/.github’scode-quality.yml, with comments noting the fleet was at zero pin violations on develop before flipping the gate. Other inputs (python,shell,soft-fail,all-files) are unchanged aside from EOF newline onall-files.Reviewed by Cursor Bugbot for commit ed80cd3. Bugbot is set up for automated code reviews on this repo. Configure here.