Problem
Every workflow in .github/workflows/ references actions by mutable major-version tag (`actions/checkout@v6`, `@v7`, `actions/setup-node@v6`/`@v7`, `actions/cache@v6`, `actions/download-artifact@v4`/`@v8`, `actions/upload-artifact@v4`/`@v7`, `actions/github-script@v9`, `actions/setup-go@v7`, `actions/setup-python@v7`, etc.), never a pinned commit SHA. Greptile flagged this on PR #2168 for a new workflow with `contents: write` + `pull-requests: write` permissions, but the underlying exposure is repo-wide: if any of these tags is ever repointed (upstream compromise or accidental force-push), any workflow using it runs unreviewed code with whatever permissions that job holds.
Fix
Standard supply-chain hardening: pin every `uses:` line to the exact commit SHA the tag currently resolves to (e.g. `actions/checkout@ # v6`), ideally repo-wide in one sweep, with Dependabot configured to open PRs bumping the pinned SHA (Dependabot supports this for GitHub Actions).
Out of scope for any single feature PR — this is a repo-wide CI convention decision, not something to fix inconsistently one workflow at a time.
Problem
Every workflow in
.github/workflows/references actions by mutable major-version tag (`actions/checkout@v6`, `@v7`, `actions/setup-node@v6`/`@v7`, `actions/cache@v6`, `actions/download-artifact@v4`/`@v8`, `actions/upload-artifact@v4`/`@v7`, `actions/github-script@v9`, `actions/setup-go@v7`, `actions/setup-python@v7`, etc.), never a pinned commit SHA. Greptile flagged this on PR #2168 for a new workflow with `contents: write` + `pull-requests: write` permissions, but the underlying exposure is repo-wide: if any of these tags is ever repointed (upstream compromise or accidental force-push), any workflow using it runs unreviewed code with whatever permissions that job holds.Fix
Standard supply-chain hardening: pin every `uses:` line to the exact commit SHA the tag currently resolves to (e.g. `actions/checkout@ # v6`), ideally repo-wide in one sweep, with Dependabot configured to open PRs bumping the pinned SHA (Dependabot supports this for GitHub Actions).
Out of scope for any single feature PR — this is a repo-wide CI convention decision, not something to fix inconsistently one workflow at a time.