Skip to content

Pin digest of 3rd party actions #30837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
re-taro wants to merge 4 commits into from
Closed

Pin digest of 3rd party actions #30837

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9cdaea9
ci: pin digest of 3rd party actions
re-taro Mar 18, 2025
0ecf197
Merge branch 'next' into ci/pin-digest
re-taro Sep 14, 2025
6346670
Merge branch 'next' into ci/pin-digest
re-taro Sep 22, 2025
021cb22
Merge branch 'next' into ci/pin-digest
re-taro Oct 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/canary-release-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:
if: github.event_name == 'workflow_dispatch' || endsWith(github.head_ref, 'with-canary-release')
steps:
- name: Fail if triggering actor is not administrator
uses: prince-chrismc/check-actor-permissions-action@v2.0.4
uses: prince-chrismc/check-actor-permissions-action@76c9ebe1cc5f00207d4ac0948be353226e27bf93 # v2.0.4
with:
permission: admin

Expand All @@ -53,19 +53,19 @@ jobs:
echo "timestamp=$(date +%s)" >> $GITHUB_OUTPUT

- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: ${{ steps.info.outputs.isFork == 'true' && steps.info.outputs.repository || null }}
ref: ${{ steps.info.outputs.sha }}
token: ${{ secrets.GH_TOKEN }}

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version-file: '.nvmrc'

- name: Cache dependencies
uses: actions/cache@v4
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
with:
path: |
~/.yarn/berry/cache
Expand Down Expand Up @@ -93,7 +93,7 @@ jobs:

- name: Replace Pull Request Body
# TODO: replace with ivangabriele/find-and-replace-pull-request-body@vX when https://github.com/ivangabriele/find-and-replace-pull-request-body/pull/11 has been released
uses: mcky/find-and-replace-pull-request-body@v1.1.6-mcky
uses: mcky/find-and-replace-pull-request-body@ffeec965b89c9284c290f2a85077a8c2c60f5040 # v1.1.6-mcky
with:
githubToken: ${{ secrets.GH_TOKEN }}
prNumber: ${{ github.event_name == 'workflow_dispatch' && inputs.pr || '' }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/cron-weekly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ jobs:
check-links:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: gaurav-nelson/github-action-markdown-link-check@v1
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1
# checks all markdown files from important folders including all subfolders
with:
# only show errors that occur instead of successful links + errors
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/danger-js.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,12 +21,12 @@ jobs:
name: Danger JS
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version-file: ".nvmrc"
- name: Danger JS
uses: danger/danger-js@11.2.6
uses: danger/danger-js@899a8200c0781b16d740c2d68a15e64530f6ab56 # 11.2.6
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/generate-sandboxes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,11 +26,11 @@ jobs:
name: Generate to next
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: next

- uses: actions/setup-node@v4
- uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version-file: '.nvmrc'

Expand Down Expand Up @@ -78,11 +78,11 @@ jobs:
name: Generate to main
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: main

- uses: actions/setup-node@v4
- uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version-file: '.nvmrc'

Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/handle-release-branches.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
if: ${{ needs.branch-checks.outputs.is-latest-branch == 'true' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- run: curl -X POST "https://api.netlify.com/build_hooks/${{ secrets.FRONTPAGE_HOOK }}"

Expand All @@ -32,7 +32,7 @@ jobs:
if: ${{ needs.branch-checks.outputs.is-next-branch == 'true' || needs.branch-checks.outputs.is-release-branch == 'true' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: next
path: next
Expand All @@ -54,7 +54,7 @@ jobs:
if: ${{ needs.branch-checks.outputs.is-next-branch == 'true' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0

Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/prepare-non-patch-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ jobs:
working-directory: scripts
steps:
- name: Checkout next
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: next
# this needs to be set to a high enough number that it will contain the last version tag
Expand All @@ -52,12 +52,12 @@ jobs:
token: ${{ secrets.GH_TOKEN }}

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version-file: ".nvmrc"

- name: Cache dependencies
uses: actions/cache@v4
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
with:
path: |
~/.yarn/berry/cache
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/prepare-patch-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,18 +25,18 @@ jobs:
working-directory: scripts
steps:
- name: Checkout main
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: main
token: ${{ secrets.GH_TOKEN }}

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version-file: ".nvmrc"

- name: Cache dependencies
uses: actions/cache@v4
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
with:
Comment on lines +28 to 40

@coderabbitai coderabbitai Bot Oct 2, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Please also pin Ilshidur/action-discord.

Nice job pinning the core actions, but this workflow still calls Ilshidur/action-discord@master (see Line 186). Leaving that third-party action unpinned keeps the same supply-chain risk we’re trying to eliminate. Please lock it to a specific commit SHA (per the PR goal/tooling you’re already using) so this workflow is fully deterministic.

🤖 Prompt for AI Agents 
.github/workflows/prepare-patch-release.yml lines 28-40 (and the workflow step
at ~line 186): the workflow pins core GitHub Actions but still references
Ilshidur/action-discord@master later, leaving a supply-chain risk; update the
discord action usage to a specific commit SHA (the same pinning style used for
other actions) by replacing the @master reference with the exact commit hash for
that release, ensuring the workflow is fully deterministic and consistent with
the other pinned actions.

path: |
~/.yarn/berry/cache
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,18 +37,18 @@ jobs:
gh run watch ${{ github.run_id }}

- name: Checkout ${{ github.ref_name }}
uses: actions/checkout@v4
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 100
token: ${{ secrets.GH_TOKEN }}

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version-file: ".nvmrc"

- name: Cache dependencies
uses: actions/cache@v4
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
with:
path: |
~/.yarn/berry/cache
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/stale.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ jobs:
stale:
runs-on: ubuntu-latest
steps:
- uses: actions/stale@v9
- uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
with:
stale-issue-message: "Hi there! Thank you for opening this issue, but it has been marked as `stale` because we need more information to move forward. Could you please provide us with the requested reproduction or additional information that could help us better understand the problem? We'd love to resolve this issue, but we can't do it without your help!"
close-issue-message: "I'm afraid we need to close this issue for now, since we can't take any action without the requested reproduction or additional information. But please don't hesitate to open a new issue if the problem persists – we're always happy to help. Thanks so much for your understanding."
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/tests-unit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,11 @@ jobs:
name: Core Unit Tests, windows-latest
runs-on: windows-11-arm
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 2
- name: Set node version
uses: actions/setup-node@v4
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
with:
node-version-file: ".nvmrc"
cache: 'yarn'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/triage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
name: Nissuer
runs-on: ubuntu-latest
steps:
- uses: balazsorban44/nissuer@1.10.0
- uses: balazsorban44/nissuer@92ef22afd6a75e5e588f5d689a1fd3433f596f82 # 1.10.0
with:
label-comments: |
{
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/trigger-circle-ci-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ jobs:
if: needs.get-parameters.outputs.workflow != ''
steps:
- name: Trigger Normal tests
uses: fjogeleit/http-request-action@v1
uses: fjogeleit/http-request-action@bf78da14118941f7e940279dd58f67e863cbeff6 # v1.16.3
with:
url: 'https://circleci.com/api/v2/project/gh/storybookjs/storybook/pipeline'
method: 'POST'
Expand Down