Pin workflow actions and service images to immutable SHAs - #58964
Merged
Conversation
Pin every tag/branch-referenced GitHub Action and the postgres service image to a full commit SHA / digest, closing the remaining mutable-ref supply-chain gap (tag and branch refs are force-pushable — the tj-actions/changed-files class, CVE-2025-30066). Edits are in the xtask workflow DSL; the YAML is regenerated with `cargo xtask workflows`. - bufbuild/buf-setup-action @v1 -> @a47c93e0 (v1.50.0) - bufbuild/buf-breaking-action @v1 -> @c57b3d84 (v1.1.4) - digitalocean/action-doctl @v2 -> @3cb39531 (v2.5.2), 2 sites - postgres:15 -> postgres:15@sha256:1b92e7a8 (multi-arch OCI index), 4 sites - deploy_docs.yml reusable workflow @main -> @3f16f7b9 The deploy_docs change pins a same-repo reusable workflow that was referenced by the mutable `main` branch. It now points to a commit; consider managing it with Dependabot or switching to a local (./.github/workflows/deploy_docs.yml) reference.
cla-bot
Bot
added
the
cla-signed
zed-community-bot
Bot
added
the
staff
swannysec
changed the title
This was referenced Jun 18, 2026
Closed
This was referenced Jul 1, 2026
This was referenced Jul 10, 2026
jonx
pushed a commit
to jonx/zed-aros
that referenced
this pull request
Jul 17, 2026
…ries#58964) Pins the remaining tag- and branch-referenced GitHub Actions and the `postgres` service image to specific commit SHAs / digests, so workflow runs resolve to fixed versions. Edited in the xtask workflow DSL and regenerated with `cargo xtask workflows`. - `bufbuild/buf-setup-action` → `a47c93e0` (v1.50.0) - `bufbuild/buf-breaking-action` → `c57b3d84` (v1.1.4) - `digitalocean/action-doctl` → `3cb39531` (v2.5.2) - `postgres:15` → `@sha256:1b92e7a8…` - `deploy_docs.yml` reusable workflow → pinned to a commit Release Notes: - N/A
jolutz
pushed a commit
to jolutz/zed
that referenced
this pull request
Aug 8, 2026
…ries#58964) Pins the remaining tag- and branch-referenced GitHub Actions and the `postgres` service image to specific commit SHAs / digests, so workflow runs resolve to fixed versions. Edited in the xtask workflow DSL and regenerated with `cargo xtask workflows`. - `bufbuild/buf-setup-action` → `a47c93e0` (v1.50.0) - `bufbuild/buf-breaking-action` → `c57b3d84` (v1.1.4) - `digitalocean/action-doctl` → `3cb39531` (v2.5.2) - `postgres:15` → `@sha256:1b92e7a8…` - `deploy_docs.yml` reusable workflow → pinned to a commit Release Notes: - N/A
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins the remaining tag- and branch-referenced GitHub Actions and the
postgresservice image to specific commit SHAs / digests, so workflow runs resolve to fixed versions. Edited in the xtask workflow DSL and regenerated withcargo xtask workflows.bufbuild/buf-setup-action→a47c93e0(v1.50.0)bufbuild/buf-breaking-action→c57b3d84(v1.1.4)digitalocean/action-doctl→3cb39531(v2.5.2)postgres:15→@sha256:1b92e7a8…deploy_docs.ymlreusable workflow → pinned to a commitRelease Notes: