From b707732ec6d7e61139c79ec4017de23fc98a842e Mon Sep 17 00:00:00 2001 From: Brian G Date: Fri, 14 Aug 2026 13:52:59 +0200 Subject: [PATCH] chore: pin GitHub Actions to commit SHAs Pin every `uses:` ref in .github/workflows and composite actions to a full 40-character commit SHA, with the original tag preserved as a comment, e.g. uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 Tags and branches are mutable; commit SHAs are not. Pinning to a SHA closes a supply-chain vector where a compromised action could replace what runs in CI without changing the tag we reference. Generated mechanically with `pinact run` (https://github.com/suzuki-shunsuke/pinact). No version bumps were applied (strict pin). --- .github/workflows/build-test.yml | 6 +++--- .github/workflows/create-release-pr.yml | 6 +++--- .github/workflows/publish-docs.yml | 6 +++--- .github/workflows/publish-release.yml | 24 ++++++++++++------------ 4 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index a95dd02..4c98b3e 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -13,9 +13,9 @@ jobs: matrix: node-version: [18.x, 20.x, 22.x] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v1 + uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6 with: node-version: ${{ matrix.node-version }} - run: yarn @@ -27,4 +27,4 @@ jobs: needs: - build-test steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 diff --git a/.github/workflows/create-release-pr.yml b/.github/workflows/create-release-pr.yml index c34ce9a..94dc3be 100644 --- a/.github/workflows/create-release-pr.yml +++ b/.github/workflows/create-release-pr.yml @@ -21,7 +21,7 @@ jobs: contents: write pull-requests: write steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 with: # This is to guarantee that the most recent tag is fetched. # This can be configured to a more reasonable value by consumers. @@ -32,10 +32,10 @@ jobs: - name: Get Node.js version id: nvm run: echo ::set-output name=NODE_VERSION::$(cat .nvmrc) - - uses: actions/setup-node@v2 + - uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2.5.2 with: node-version: ${{ steps.nvm.outputs.NODE_VERSION }} - - uses: MetaMask/action-create-release-pr@v1 + - uses: MetaMask/action-create-release-pr@c2131cc326cb7e95644b147a107ccb60af87eaf6 # v1.5.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml index 598db63..7b07585 100644 --- a/.github/workflows/publish-docs.yml +++ b/.github/workflows/publish-docs.yml @@ -22,13 +22,13 @@ jobs: if: ${{ inputs.destination_dir == '' }} run: exit 1 - name: Checkout the repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version-file: '.nvmrc' cache: 'yarn' - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 id: restore-build with: path: | diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 3b8d666..5fcf386 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -16,7 +16,7 @@ jobs: IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }} runs-on: ubuntu-latest steps: - - uses: MetaMask/action-is-release@v1 + - uses: MetaMask/action-is-release@ae1ebc864afddef847279b999952c7b8fbe21005 # v1.1.0 id: is-release publish-release: permissions: @@ -25,21 +25,21 @@ jobs: if: needs.is-release.outputs.IS_RELEASE == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.sha }} - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version-file: ".nvmrc" - - uses: MetaMask/action-publish-release@v3 + - uses: MetaMask/action-publish-release@f01f1be110d60fb07d86c880ce3d6bdb353524d3 # v3.3.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Install run: | yarn install yarn build - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 id: restore-build with: path: | @@ -50,10 +50,10 @@ jobs: runs-on: ubuntu-latest needs: publish-release steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.sha }} - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 id: restore-build with: path: | @@ -62,7 +62,7 @@ jobs: key: ${{ github.sha }} - name: Dry Run Publish # omit npm-token token to perform dry run publish - uses: MetaMask/action-npm-publish@v1 + uses: MetaMask/action-npm-publish@4c4dcb72354194a2028a9ff881250130afd0089c # v1 env: SKIP_PREPACK: true publish-npm: @@ -70,10 +70,10 @@ jobs: runs-on: ubuntu-latest needs: publish-npm-dry-run steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.sha }} - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 id: restore-build with: path: | @@ -81,7 +81,7 @@ jobs: ./node_modules/.yarn-state.yml key: ${{ github.sha }} - name: Publish - uses: MetaMask/action-npm-publish@v1 + uses: MetaMask/action-npm-publish@4c4dcb72354194a2028a9ff881250130afd0089c # v1 with: # This `NPM_TOKEN` needs to be manually set per-repository. # Look in the repository settings under "Environments", and set this token in the `npm-publish` environment. @@ -94,7 +94,7 @@ jobs: outputs: RELEASE_VERSION: ${{ steps.get-release-version.outputs.RELEASE_VERSION }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ github.sha }} - id: get-release-version