Skip to content

chore: pin all GitHub Actions to commit SHAs #420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
KooshaPari wants to merge 21 commits into from
Closed

chore: pin all GitHub Actions to commit SHAs #420

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
bcf56fe
ci: repair invalid workflow syntax
Apr 24, 2026
d7d6884
ci: scope legacy broad workflows
Apr 24, 2026
048a969
chore(ci): adopt phenotype-tooling workflows (wave-2)
Apr 24, 2026
8873600
feat(tracera): tracertm.cli stub with all command modules
KooshaPari Apr 25, 2026
19e9a9a
docs(worklog): bootstrap worklog scaffolding (org-wide gap closure)
KooshaPari Apr 25, 2026
f912325
chore: add MIT LICENSE and update README
KooshaPari Apr 26, 2026
86a635e
chore(dependabot): exclude ARCHIVE paths from advisory scans
KooshaPari Apr 26, 2026
a5bd0dd
chore(archive): remove docs/archive/ (42 files, pure-docs no live refs)
KooshaPari Apr 26, 2026
cad3483
chore(archive): remove data/backup/ (genesis-commit data dump, no liv…
KooshaPari Apr 26, 2026
cf75f33
docs: repoint worklogs README to local docs
KooshaPari Apr 28, 2026
da57a89
docs: fix Tracera worklog index pointer
KooshaPari Apr 28, 2026
519af07
docs: fix Trace research master index link
KooshaPari Apr 28, 2026
53e7b39
docs: fix Tracera getting-started index links
KooshaPari Apr 28, 2026
a14fc79
docs: fix RTM deep-dive master index link
KooshaPari Apr 28, 2026
1aefece
docs: fix archive current project overview link
KooshaPari Apr 28, 2026
afee807
docs: retarget README docs links
KooshaPari Apr 28, 2026
728a940
docs: add tracera sladge badge
KooshaPari Apr 30, 2026
3267a84
chore: pin actions/checkout to SHA
KooshaPari Apr 30, 2026
e3d5cee
chore: pin actions/checkout to immutable SHA (b4ffde65)
KooshaPari Apr 30, 2026
fab1068
chore: pin all actions to immutable SHA
KooshaPari Apr 30, 2026
8a22fc7
fix(governance): rewrite CLAUDE.md — was incorrectly labeled TypeScri…
KooshaPari May 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,14 @@ version: 2

# Dependabot configuration for automated dependency updates
# This configuration covers all package ecosystems in the TraceRTM project
#
# Archive/legacy paths are intentionally NOT scanned:
# - /ARCHIVE/CONFIG/** (legacy config, alerts batch-dismissed 2026-04)
# - /ARCHIVE/** (any archived subtree)
# All `directory:` entries below point to ACTIVE paths only.
# Do NOT add ARCHIVE/** paths to any `directory:` or `directories:` field.
# If an archive is reactivated, restore it under an active path instead of
# pointing Dependabot at ARCHIVE/.

updates:
# Frontend monorepo (npm/bun)
Expand Down Expand Up @@ -88,7 +96,9 @@ updates:

# Python backend (root pyproject.toml)
- package-ecosystem: "pip"
directory: "/"
directories:
- "/"
- "!/ARCHIVE/**"
Comment on lines +99 to +101
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/dependabot.yml

Repository: KooshaPari/Tracera

Length of output: 9397

🌐 Web query:

Dependabot directories exclude-paths configuration options github yml

💡 Result:

The exclude-paths option in Dependabot's dependabot.yml configuration allows you to specify directories and files to ignore when scanning for manifests and dependencies. It uses glob patterns relative to the directory specified in the update configuration. Key details: - Purpose: Prevents Dependabot from creating update PRs for dependencies in test assets, vendored code, examples, or other non-production locations. - Location: Under each package-ecosystem entry in the updates section. - Default behavior: Scans all files in the specified directory unless excluded. - Syntax: List of glob patterns, e.g.: version: 2 updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "daily" exclude-paths: - "src/test/assets" - "vendor/" - "src/.js" - "src/test/helper.js" - Supported glob patterns: (recursive), * (single segment), e.g., test/, /.md, *.lock. - Scope: Applies per ecosystem; patterns relative to directory. Does not affect security updates (as of 2026). - Related: Use with directory or directories (which supports globs). Complements ignore for dependency names/versions. This feature reached general availability in August 2025.

Citations:

Replace the negated directories entries with exclude-paths.

The negated directory syntax !/ARCHIVE/** is not supported in Dependabot's documented schema. The proper mechanism for excluding paths is exclude-paths with positive glob patterns. Update both the pip (lines 99-101) and github-actions (lines 249-251) blocks to use directory: "/" with exclude-paths: ["ARCHIVE/**"].

♻️ Proposed fix 
-  - package-ecosystem: "pip"
-    directories:
-      - "/"
-      - "!/ARCHIVE/**"
+  - package-ecosystem: "pip"
+    directory: "/"
+    exclude-paths:
+      - "ARCHIVE/**"
-  - package-ecosystem: "github-actions"
-    directories:
-      - "/"
-      - "!/ARCHIVE/**"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    exclude-paths:
+      - "ARCHIVE/**"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
directories:
- "/"
- "!/ARCHIVE/**"
directory: "/"
exclude-paths:
- "ARCHIVE/**"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/dependabot.yml around lines 99 - 101, Replace the unsupported
negated directories entry (e.g., "- \"/\"; - \"!/ARCHIVE/**\"") in the pip and
github-actions dependabot blocks with the documented keys: set directory: "/"
and add exclude-paths: ["ARCHIVE/**"]; locate the pip block and the
github-actions block in the Dependabot config (search for the pip
package-ecosystem and github-actions package-ecosystem blocks) and remove the
negated directories list, then add directory: "/" plus exclude-paths:
["ARCHIVE/**"] so Dependabot uses the supported exclusion mechanism.

schedule:
interval: "weekly"
day: "tuesday"
Expand Down Expand Up @@ -236,7 +246,9 @@ updates:

# GitHub Actions workflows
- package-ecosystem: "github-actions"
directory: "/"
directories:
- "/"
- "!/ARCHIVE/**"
schedule:
interval: "weekly"
day: "thursday"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/alert-sync-issues.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Sync CI/Dependabot/CodeQL Alerts To Issues
uses: actions/github-script@v7
uses: actions/github-script@0057852bfaa89a56745cba8c7296529d2fc39830
with:
script: |
const owner = context.repo.owner;
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/architecture.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,15 +10,15 @@ jobs:
architecture:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Install UV
uses: astral-sh/setup-uv@v2
with:
version: "latest"

- name: Set up Python
uses: actions/setup-python@v5
uses: actions/setup-python@ea165f8d65b6e75b540449e92b4886f43607fa02
with:
cache: 'pip'
with:
Expand All @@ -34,14 +34,14 @@ jobs:
run: tach show --mermaid > architecture.md

- name: Upload architecture diagram
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@6f8efc29b200d32929f49075959781ed54ec270c
with:
name: architecture-diagram
path: architecture.md

- name: Comment architecture on PR
if: github.event_name == 'pull_request'
uses: actions/github-script@v7
uses: actions/github-script@0057852bfaa89a56745cba8c7296529d2fc39830
with:
script: |
const fs = require('fs');
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/benchmarks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- uses: actions/setup-go@330a01c490aca151604b8cf639adc76d48f6c5d4
with:
Comment on lines +17 to 18
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/benchmarks.yml

Repository: KooshaPari/Tracera

Length of output: 1214

🌐 Web query:

setup-go 330a01c490aca151604b8cf639adc76d48f6c5d4 GitHub

💡 Result:

The GitHub repo for setup-go is actions/setup-go (GitHub Actions action “actions/setup-go”, used to set up a Go toolchain in CI). Your specific identifier “330a01c490aca151604b8cf639adc76d48f6c5d4” does not resolve to a commit in the canonical actions/setup-go repository in the public web results I found. The hash may instead refer to some other repo/fork, or to a truncated/non-matching value used in another system log. Authoritative references for the action itself (usage + behavior): - https://github.com/actions/setup-go - https://github.com/actions/setup-go/blob/main/action.yml If you want, paste the exact URL where you saw that 330a… hash (or the file/log snippet around it), and I can trace it to the exact commit/repo or explain what it refers to.

Citations:

🌐 Web query:

upload-artifact 6f8efc29b200d32929f49075959781ed54ec270c GitHub

💡 Result:

The string "6f8efc29b200d32929f49075959781ed54ec270c" is the Git commit SHA (short or full ref) for version v3.5.0 of the GitHub Actions "actions/cache" action. It is used in GitHub Actions workflows pinned to a specific commit for reproducibility and security, e.g., uses: actions/cache@6f8efc2. This version is deprecated and runs on Node.js 20, which is scheduled for deprecation (warnings appear in workflows using it as of 2026). Users are advised to upgrade to v5.0.4 or later, which supports Node.js 24. The query mentions "upload-artifact" but matches this cache action ref, commonly used alongside upload-artifact in workflows.

Citations:

🌐 Web query:

actions/setup-go latest SHA commit v5

💡 Result:

The latest actions/setup-go v5 is v5.5.0 (released 2025-05-08). However, the sources found in this research do not explicitly provide the full 40-character commit SHA that corresponds to the v5.5.0 tag. What you can use instead: - Use the tag itself in workflows: uses: actions/setup-go@v5 (or @v5.5.0 for a fixed version). - To get the exact SHA for the v5.5.0 tag at runtime, you can resolve the tag in GitHub/Git locally (example): git ls-remote https://github.com/actions/setup-go.git refs/tags/v5.5.0 Evidence: the GitHub release page shows v5.5.0 as a v5 release, and the repository indicates the latest release is v6.4.0 (2026-03-30); but tag-to-SHA mapping was not surfaced in the captured snippets.

Citations:

🌐 Web query:

actions/upload-artifact latest SHA v4

💡 Result:

The latest SHA for actions/upload-artifact@v4 (the v4 branch) is not explicitly stated in search results, but the v4 branch exists and points to the latest commit on that maintenance branch for v4.x releases. The most recent v4.x release mentioned is v4.6.0 from January 2025 (https://github.com/actions/upload-artifact/releases/tag/v4.6.0). When using actions/upload-artifact@v4 in GitHub Actions workflows, GitHub resolves it to the latest commit SHA on the v4 branch. A specific pinned SHA example from a related action is ea165f8d65b6e75b540449e92b4886f43607fa02 (from September 2025), likely corresponding to a v4.x version at that time. The repository's main branch latest release is v7.0.1 (April 2026), but v4 remains available for compatibility.

Citations:

🌐 Web query:

330a01c490aca151604b8cf639adc76d48f6c5d4 GitHub commit

💡 Result:

The GitHub commit 330a01c490aca151604b8cf639adc76d48f6c5d4 is the merge commit for pull request #734 in the actions/upload-artifact repository. It merges the branch danwkennedy/prepare-5.0.0, which prepares the upload-artifact action for version v5.0.0. Key changes include bumping the package version from 4.6.2 to 5.0.0 and updating the @actions/artifact dependency from ^2.3.2 to ^4.0.0. The commit was made on 2025-10-24 by GitHub (automated), authored by danwkennedy. It affects 6 files with 6076 additions and 10951 deletions, primarily updating package.json, package-lock.json, and dist files. This commit tags v5.0.0 and is widely referenced in workflows pinning to actions/upload-artifact@330a01c for immutability (e.g., # v5.0.0). Official GitHub page: actions/upload-artifact@330a01c

Citations:

SHAs in the benchmark workflow are assigned to the wrong action repositories and will cause workflow failures.

Line 17 pins actions/setup-go@330a01c490aca151604b8cf639adc76d48f6c5d4, but that SHA is actually from actions/upload-artifact v5.0.0.

Line 27 pins actions/upload-artifact@6f8efc29b200d32929f49075959781ed54ec270c, but that SHA is actually from actions/cache v3.5.0.

These misassignments will cause the workflow to fail immediately when GitHub attempts to fetch the commits from the incorrect repositories.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/benchmarks.yml around lines 17 - 18, The workflow pins
incorrect commit SHAs to the wrong action repos; update the pinned refs so each
action uses a SHA that belongs to its repository (or replace the SHA with the
official stable tag). Specifically, for the actions/setup-go step (currently
using SHA 330a01c...) replace that ref with the correct actions/setup-go commit
SHA for the desired version or use the official tag (e.g., actions/setup-go@v4),
and for the actions/upload-artifact step (currently using SHA 6f8efc2...)
replace that ref with the correct actions/upload-artifact commit SHA or use its
official tag (e.g., actions/upload-artifact@v5); ensure the refs you choose
match the repository names (actions/setup-go, actions/upload-artifact) so GitHub
can fetch the correct commits.

go-version: '1.23'
cache-dependency-path: backend/go.sum
Expand All @@ -24,7 +24,7 @@ jobs:
GOTOOLCHAIN: local
run: go test ./benchmarks/... -bench=. -benchmem -count=3 -timeout=5m | tee benchmark-results.txt
- name: Upload benchmark results
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@6f8efc29b200d32929f49075959781ed54ec270c
with:
name: go-benchmark-results
path: backend/benchmark-results.txt
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/canary-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Validate image tag
run: |
Expand Down Expand Up @@ -79,7 +79,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Configure kubectl
run: |
Expand Down Expand Up @@ -139,7 +139,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Configure kubectl
run: |
Expand Down Expand Up @@ -210,7 +210,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Configure kubectl
run: |
Expand Down Expand Up @@ -267,7 +267,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Configure kubectl
run: |
Expand Down Expand Up @@ -341,7 +341,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Configure kubectl
run: |
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/chaos-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,10 +77,10 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Set up Python ${{ env.PYTHON_VERSION }}
uses: actions/setup-python@v5
uses: actions/setup-python@ea165f8d65b6e75b540449e92b4886f43607fa02
with:
cache: 'pip'
with:
Expand Down Expand Up @@ -188,7 +188,7 @@ jobs:

- name: Upload chaos test results
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@6f8efc29b200d32929f49075959781ed54ec270c
with:
name: chaos-test-results
path: |
Expand All @@ -215,7 +215,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Set up kubectl
uses: azure/setup-kubectl@v4
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/chromatic.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,12 +32,12 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
fetch-depth: 0

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
with:
cache: 'npm'
with:
Expand All @@ -50,7 +50,7 @@ jobs:
bun-version: latest

- name: Cache Bun dependencies
uses: actions/cache@v3
uses: actions/cache@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4
with:
path: ~/.bun/install/cache
key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lockb') }}
Expand All @@ -73,15 +73,15 @@ jobs:

- name: Upload chromatic report
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@6f8efc29b200d32929f49075959781ed54ec270c
with:
name: chromatic-report
path: frontend/apps/web/junit-report.xml
retention-days: 30

- name: Comment PR with results
if: github.event_name == 'pull_request' && always()
uses: actions/github-script@v7
uses: actions/github-script@0057852bfaa89a56745cba8c7296529d2fc39830
with:
script: |
const fs = require('fs');
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/ci-cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
outputs:
code: ${{ steps.filter.outputs.code }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
fetch-depth: 0
- id: filter
Expand Down Expand Up @@ -53,10 +53,10 @@ jobs:
- 5432:5432

steps:
- uses: actions/checkout@v3
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Set up Python
uses: actions/setup-python@v4
uses: actions/setup-python@0057852bfaa89a56745cba8c7296529d2fc39830
Copy link
Copy Markdown

@cursor cursor Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wrong SHA pins setup-python to github-script action

High Severity

The SHA 0057852bfaa89a56745cba8c7296529d2fc39830 is the commit hash for actions/github-script, but it's being used to pin actions/setup-python in four locations. Every other setup-python reference in the repo correctly uses ea165f8d65b6e75b540449e92b4886f43607fa02. This will cause the affected CI jobs (test, lint, build, deploy in ci-cd.yml, backend Python tests in test-validation.yml, CLI tests in test.yml) to fail at the Python setup step.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit fab1068. Configure here.

with:
python-version: '3.11'

Expand All @@ -83,10 +83,10 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v3
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Set up Python
uses: actions/setup-python@v4
uses: actions/setup-python@0057852bfaa89a56745cba8c7296529d2fc39830
with:
python-version: '3.11'

Expand All @@ -111,7 +111,7 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v3
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
Expand All @@ -129,7 +129,7 @@ jobs:
if: github.ref == 'refs/heads/main' && github.event_name == 'push'

steps:
- uses: actions/checkout@v3
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

- name: Deploy to production
run: |
Expand Down
Loading
Loading