Is your feature request related to a problem?
The repository currently references GitHub Actions using version tags (such as @v4 or @v5). While these tags are convenient, they are mutable and can point to different commits over time. This introduces a software supply chain risk, as workflow behavior may change unexpectedly if an action tag is updated.
Proposed Solution
Update all GitHub Actions workflows to reference actions by their immutable commit SHAs instead of mutable version tags.
The implementation should:
- Audit all existing GitHub Actions workflows.
- Replace version tags (e.g.,
@v4, @v5) with the corresponding full commit SHAs.
- Verify that all workflows continue to function correctly after the update.
- Document the process for updating pinned SHAs in future maintenance.
This change will improve workflow reproducibility and reduce the risk of unexpected behavior caused by mutable action versions.
Alternatives Considered
An alternative is to continue using version tags while periodically reviewing and updating them. Although this approach is easier to maintain, it still relies on mutable references and does not provide the same level of supply chain security as pinning actions to immutable commit SHAs.
Additional Context
Pinning GitHub Actions to immutable commit SHAs is recommended by GitHub and is considered a software supply chain security best practice. It ensures workflows execute using reviewed, fixed versions of actions, improving reproducibility and reducing the attack surface associated with third-party GitHub Actions.
Is your feature request related to a problem?
The repository currently references GitHub Actions using version tags (such as
@v4or@v5). While these tags are convenient, they are mutable and can point to different commits over time. This introduces a software supply chain risk, as workflow behavior may change unexpectedly if an action tag is updated.Proposed Solution
Update all GitHub Actions workflows to reference actions by their immutable commit SHAs instead of mutable version tags.
The implementation should:
@v4,@v5) with the corresponding full commit SHAs.This change will improve workflow reproducibility and reduce the risk of unexpected behavior caused by mutable action versions.
Alternatives Considered
An alternative is to continue using version tags while periodically reviewing and updating them. Although this approach is easier to maintain, it still relies on mutable references and does not provide the same level of supply chain security as pinning actions to immutable commit SHAs.
Additional Context
Pinning GitHub Actions to immutable commit SHAs is recommended by GitHub and is considered a software supply chain security best practice. It ensures workflows execute using reviewed, fixed versions of actions, improving reproducibility and reducing the attack surface associated with third-party GitHub Actions.