{"thread":{"id":"66647","subject":"[PATCH] ci: pin actions in the main workflow to full commit IDs","startedAt":"2026-10-23T16:38:23Z","lastAt":"2026-10-26T18:20:37Z","messageCount":7,"participants":["Taylor Blau","Ben Knoble","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"556076","messageId":"a178dde02a80324d4cb52781d542ee575cbb68a1.1792773333.git.ttaylorr@openai.com","threadId":"66647","inReplyTo":null,"subject":"[PATCH] ci: pin actions in the main workflow to full commit IDs","fromName":"Taylor Blau","fromEmail":"ttaylorr@openai.com","sentAt":"2026-10-23T16:38:23Z","receivedAt":"2026-10-23T16:38:23Z","isPatch":true,"sender":{"key":"me@ttaylorr.com","avatar":"https://avatars.githubusercontent.com/u/301000140?v=4"},"body":"Some forks are hosted by organizations that restrict which GitHub\nActions may run, including requiring actions to be pinned to full\ncommit IDs. Our main CI workflow refers to actions by version tags or\nbranches, which prevents it from running under such a policy.\n\nPin those actions to full commit IDs, retaining the version names in\ncomments to make future updates easier to review.\n\nSigned-off-by: Taylor Blau <ttaylorr@openai.com>\n---\nThis is based on a merge of 'ps/ci-housekeeping-and-modernizations'\nand 'jk/http-curl-strip-creds'. The latter is needed for the HTTP\nauth tests to pass with the curl versions in current CI.\n\n .github/workflows/main.yml | 64 +++++++++++++++++++-------------------\n 1 file changed, 32 insertions(+), 32 deletions(-)\n\ndiff --git a/.github/workflows/main.yml b/.github/workflows/main.yml\nindex fe8155772ab..ba0b5ffb634 100644\n--- a/.github/workflows/main.yml\n+++ b/.github/workflows/main.yml\n@@ -65,7 +65,7 @@ jobs:\n           echo \"skip_concurrent=$skip_concurrent\" >>$GITHUB_OUTPUT\n       - name: skip if the commit or tree was already tested\n         id: skip-if-redundant\n-        uses: actions/github-script@v9\n+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9\n         if: steps.check-ref.outputs.enabled == 'yes'\n         with:\n           github-token: ${{secrets.GITHUB_TOKEN}}\n@@ -114,8 +114,8 @@ jobs:\n       group: windows-build-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n-    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n     - name: Install GCC-compatible Rust target\n       shell: bash\n       run: |\n@@ -149,7 +149,7 @@ jobs:\n     - name: zip up tracked files\n       run: git archive -o artifacts/tracked.tar.gz HEAD\n     - name: upload tracked files and build artifacts\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: windows-artifacts\n         path: artifacts\n@@ -166,14 +166,14 @@ jobs:\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n     - name: download tracked files and build artifacts\n-      uses: actions/download-artifact@v8\n+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\n       with:\n         name: windows-artifacts\n         path: ${{github.workspace}}\n     - name: extract tracked files and build artifacts\n       shell: bash\n       run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz\n-    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n     - name: test\n       shell: bash\n       run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10\n@@ -183,7 +183,7 @@ jobs:\n       run: ci/print-test-failures.sh\n     - name: Upload failed tests' directories\n       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: failed-tests-windows-${{ matrix.nr }}\n         path: ${{env.FAILED_TEST_ARTIFACTS}}\n@@ -199,20 +199,20 @@ jobs:\n       group: vs-build-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n-    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n     - name: initialize vcpkg\n-      uses: actions/checkout@v6\n+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n       with:\n         repository: 'microsoft/vcpkg'\n         path: 'compat/vcbuild/vcpkg'\n     - name: download vcpkg artifacts\n-      uses: git-for-windows/get-azure-pipelines-artifact@v0\n+      uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0\n       with:\n         repository: git/git\n         definitionId: 9\n     - name: add msbuild to PATH\n-      uses: microsoft/setup-msbuild@v3\n+      uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3\n     - name: copy dlls to root\n       shell: cmd\n       run: compat\\vcbuild\\vcpkg_copy_dlls.bat release\n@@ -234,7 +234,7 @@ jobs:\n     - name: zip up tracked files\n       run: git archive -o artifacts/tracked.tar.gz HEAD\n     - name: upload tracked files and build artifacts\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: vs-artifacts\n         path: artifacts\n@@ -250,9 +250,9 @@ jobs:\n       group: vs-test-${{ matrix.nr }}-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n     - name: download tracked files and build artifacts\n-      uses: actions/download-artifact@v8\n+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\n       with:\n         name: vs-artifacts\n         path: ${{github.workspace}}\n@@ -270,7 +270,7 @@ jobs:\n       run: ci/print-test-failures.sh\n     - name: Upload failed tests' directories\n       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: failed-tests-windows-vs-${{ matrix.nr }}\n         path: ${{env.FAILED_TEST_ARTIFACTS}}\n@@ -284,8 +284,8 @@ jobs:\n       group: windows-meson-build-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n-    - uses: actions/setup-python@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6\n     - name: Set up dependencies\n       shell: pwsh\n       run: pip install meson ninja\n@@ -296,7 +296,7 @@ jobs:\n       shell: pwsh\n       run: meson compile -C build\n     - name: Upload build artifacts\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: windows-meson-artifacts\n         path: build\n@@ -312,13 +312,13 @@ jobs:\n       group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n-    - uses: actions/setup-python@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6\n     - name: Set up dependencies\n       shell: pwsh\n       run: pip install meson ninja\n     - name: Download build artifacts\n-      uses: actions/download-artifact@v8\n+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\n       with:\n         name: windows-meson-artifacts\n         path: build\n@@ -331,7 +331,7 @@ jobs:\n       run: ci/print-test-failures.sh\n     - name: Upload failed tests' directories\n       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: failed-tests-windows-meson-${{ matrix.nr }}\n         path: ${{env.FAILED_TEST_ARTIFACTS}}\n@@ -367,7 +367,7 @@ jobs:\n       TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t\n     runs-on: ${{matrix.vector.pool}}\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: ci/run-build-and-tests.sh\n     - name: print test failures\n@@ -375,7 +375,7 @@ jobs:\n       run: ci/print-test-failures.sh\n     - name: Upload failed tests' directories\n       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: failed-tests-${{matrix.vector.jobname}}\n         path: ${{env.FAILED_TEST_ARTIFACTS}}\n@@ -388,7 +388,7 @@ jobs:\n       CI_JOB_IMAGE: ubuntu-latest\n     runs-on: ubuntu-latest\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: ci/run-build-and-minimal-fuzzers.sh\n   dockerized:\n@@ -464,7 +464,7 @@ jobs:\n         else\n           apt-get -q update && apt-get -q -y install git\n         fi\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: useradd builder --create-home\n     - run: chown -R builder .\n@@ -474,7 +474,7 @@ jobs:\n       run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh\n     - name: Upload failed tests' directories\n       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: failed-tests-${{matrix.vector.jobname}}\n         path: ${{env.FAILED_TEST_ARTIFACTS}}\n@@ -489,7 +489,7 @@ jobs:\n       group: static-analysis-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: ci/run-static-analysis.sh\n     - run: ci/check-directional-formatting.bash\n@@ -505,7 +505,7 @@ jobs:\n       group: rust-analysis-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: ci/run-rust-checks.sh\n   sparse:\n@@ -519,7 +519,7 @@ jobs:\n       group: sparse-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - name: Install other dependencies\n       run: ci/install-dependencies.sh\n     - run: make sparse\n@@ -535,6 +535,6 @@ jobs:\n       CI_JOB_IMAGE: ubuntu-latest\n     runs-on: ubuntu-latest\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: ci/test-documentation.sh\n\nbase-commit: d46921825429c74931372567941eaf98d4483210\n--\n2.56.0.187.g9e9ae442333\n\n"},{"id":"556090","messageId":"CA205F3D-2071-48D5-9986-5FF3F4AB8F68@gmail.com","threadId":"66647","inReplyTo":"a178dde02a80324d4cb52781d542ee575cbb68a1.1792773333.git.ttaylorr@openai.com","subject":"Re: [PATCH] ci: pin actions in the main workflow to full commit IDs","fromName":"Ben Knoble","fromEmail":"ben.knoble@gmail.com","sentAt":"2026-10-23T18:05:00Z","receivedAt":"2026-10-23T18:05:00Z","isPatch":true,"sender":{"key":"ben.knoble@gmail.com","avatar":"https://avatars.githubusercontent.com/u/22802209?v=4"},"body":"\n> Le 23 oct. 2026 à 12:41, Taylor Blau <ttaylorr@openai.com> a écrit :\n> \n> Some forks are hosted by organizations that restrict which GitHub\n> Actions may run, including requiring actions to be pinned to full\n> commit IDs. Our main CI workflow refers to actions by version tags or\n> branches, which prevents it from running under such a policy.\n\nYep. This is becoming de facto security standard.\n\nPerhaps we should say so? « Pinned commit IDs prevent attacks\non CI and any secrets stored therein by compromised action suppliers »\nor something?\n\n> Pin those actions to full commit IDs, retaining the version names in\n> comments to make future updates easier to review.\n> \n> Signed-off-by: Taylor Blau <ttaylorr@openai.com>\n> ---\n> This is based on a merge of 'ps/ci-housekeeping-and-modernizations'\n> and 'jk/http-curl-strip-creds'. The latter is needed for the HTTP\n> auth tests to pass with the curl versions in current CI.\n> \n> .github/workflows/main.yml | 64 +++++++++++++++++++-------------------\n> 1 file changed, 32 insertions(+), 32 deletions(-)\n> \n> diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml\n> index fe8155772ab..ba0b5ffb634 100644\n> --- a/.github/workflows/main.yml\n> +++ b/.github/workflows/main.yml\n> @@ -65,7 +65,7 @@ jobs:\n>           echo \"skip_concurrent=$skip_concurrent\" >>$GITHUB_OUTPUT\n>       - name: skip if the commit or tree was already tested\n>         id: skip-if-redundant\n> -        uses: actions/github-script@v9\n> +        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9\n>         if: steps.check-ref.outputs.enabled == 'yes'\n>         with:\n>           github-token: ${{secrets.GITHUB_TOKEN}}\n> @@ -114,8 +114,8 @@ jobs:\n>       group: windows-build-${{ github.ref }}\n>       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n>     steps:\n> -    - uses: actions/checkout@v6\n> -    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n> +    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n>     - name: Install GCC-compatible Rust target\n>       shell: bash\n>       run: |\n> @@ -149,7 +149,7 @@ jobs:\n>     - name: zip up tracked files\n>       run: git archive -o artifacts/tracked.tar.gz HEAD\n>     - name: upload tracked files and build artifacts\n> -      uses: actions/upload-artifact@v7\n> +      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n>       with:\n>         name: windows-artifacts\n>         path: artifacts\n> @@ -166,14 +166,14 @@ jobs:\n>       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n>     steps:\n>     - name: download tracked files and build artifacts\n> -      uses: actions/download-artifact@v8\n> +      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\n>       with:\n>         name: windows-artifacts\n>         path: ${{github.workspace}}\n>     - name: extract tracked files and build artifacts\n>       shell: bash\n>       run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz\n> -    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n> +    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n>     - name: test\n>       shell: bash\n>       run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10\n> @@ -183,7 +183,7 @@ jobs:\n>       run: ci/print-test-failures.sh\n>     - name: Upload failed tests' directories\n>       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n> -      uses: actions/upload-artifact@v7\n> +      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n>       with:\n>         name: failed-tests-windows-${{ matrix.nr }}\n>         path: ${{env.FAILED_TEST_ARTIFACTS}}\n> @@ -199,20 +199,20 @@ jobs:\n>       group: vs-build-${{ github.ref }}\n>       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n>     steps:\n> -    - uses: actions/checkout@v6\n> -    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n> +    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n>     - name: initialize vcpkg\n> -      uses: actions/checkout@v6\n> +      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n>       with:\n>         repository: 'microsoft/vcpkg'\n>         path: 'compat/vcbuild/vcpkg'\n>     - name: download vcpkg artifacts\n> -      uses: git-for-windows/get-azure-pipelines-artifact@v0\n> +      uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0\n>       with:\n>         repository: git/git\n>         definitionId: 9\n>     - name: add msbuild to PATH\n> -      uses: microsoft/setup-msbuild@v3\n> +      uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3\n>     - name: copy dlls to root\n>       shell: cmd\n>       run: compat\\vcbuild\\vcpkg_copy_dlls.bat release\n> @@ -234,7 +234,7 @@ jobs:\n>     - name: zip up tracked files\n>       run: git archive -o artifacts/tracked.tar.gz HEAD\n>     - name: upload tracked files and build artifacts\n> -      uses: actions/upload-artifact@v7\n> +      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n>       with:\n>         name: vs-artifacts\n>         path: artifacts\n> @@ -250,9 +250,9 @@ jobs:\n>       group: vs-test-${{ matrix.nr }}-${{ github.ref }}\n>       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n>     steps:\n> -    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n> +    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n>     - name: download tracked files and build artifacts\n> -      uses: actions/download-artifact@v8\n> +      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\n>       with:\n>         name: vs-artifacts\n>         path: ${{github.workspace}}\n> @@ -270,7 +270,7 @@ jobs:\n>       run: ci/print-test-failures.sh\n>     - name: Upload failed tests' directories\n>       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n> -      uses: actions/upload-artifact@v7\n> +      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n>       with:\n>         name: failed-tests-windows-vs-${{ matrix.nr }}\n>         path: ${{env.FAILED_TEST_ARTIFACTS}}\n> @@ -284,8 +284,8 @@ jobs:\n>       group: windows-meson-build-${{ github.ref }}\n>       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n>     steps:\n> -    - uses: actions/checkout@v6\n> -    - uses: actions/setup-python@v6\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n> +    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6\n>     - name: Set up dependencies\n>       shell: pwsh\n>       run: pip install meson ninja\n> @@ -296,7 +296,7 @@ jobs:\n>       shell: pwsh\n>       run: meson compile -C build\n>     - name: Upload build artifacts\n> -      uses: actions/upload-artifact@v7\n> +      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n>       with:\n>         name: windows-meson-artifacts\n>         path: build\n> @@ -312,13 +312,13 @@ jobs:\n>       group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }}\n>       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n>     steps:\n> -    - uses: actions/checkout@v6\n> -    - uses: actions/setup-python@v6\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n> +    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6\n>     - name: Set up dependencies\n>       shell: pwsh\n>       run: pip install meson ninja\n>     - name: Download build artifacts\n> -      uses: actions/download-artifact@v8\n> +      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\n>       with:\n>         name: windows-meson-artifacts\n>         path: build\n> @@ -331,7 +331,7 @@ jobs:\n>       run: ci/print-test-failures.sh\n>     - name: Upload failed tests' directories\n>       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n> -      uses: actions/upload-artifact@v7\n> +      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n>       with:\n>         name: failed-tests-windows-meson-${{ matrix.nr }}\n>         path: ${{env.FAILED_TEST_ARTIFACTS}}\n> @@ -367,7 +367,7 @@ jobs:\n>       TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t\n>     runs-on: ${{matrix.vector.pool}}\n>     steps:\n> -    - uses: actions/checkout@v6\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n>     - run: ci/install-dependencies.sh\n>     - run: ci/run-build-and-tests.sh\n>     - name: print test failures\n> @@ -375,7 +375,7 @@ jobs:\n>       run: ci/print-test-failures.sh\n>     - name: Upload failed tests' directories\n>       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n> -      uses: actions/upload-artifact@v7\n> +      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n>       with:\n>         name: failed-tests-${{matrix.vector.jobname}}\n>         path: ${{env.FAILED_TEST_ARTIFACTS}}\n> @@ -388,7 +388,7 @@ jobs:\n>       CI_JOB_IMAGE: ubuntu-latest\n>     runs-on: ubuntu-latest\n>     steps:\n> -    - uses: actions/checkout@v6\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n>     - run: ci/install-dependencies.sh\n>     - run: ci/run-build-and-minimal-fuzzers.sh\n>   dockerized:\n> @@ -464,7 +464,7 @@ jobs:\n>         else\n>           apt-get -q update && apt-get -q -y install git\n>         fi\n> -    - uses: actions/checkout@v6\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n>     - run: ci/install-dependencies.sh\n>     - run: useradd builder --create-home\n>     - run: chown -R builder .\n> @@ -474,7 +474,7 @@ jobs:\n>       run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh\n>     - name: Upload failed tests' directories\n>       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n> -      uses: actions/upload-artifact@v7\n> +      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n>       with:\n>         name: failed-tests-${{matrix.vector.jobname}}\n>         path: ${{env.FAILED_TEST_ARTIFACTS}}\n> @@ -489,7 +489,7 @@ jobs:\n>       group: static-analysis-${{ github.ref }}\n>       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n>     steps:\n> -    - uses: actions/checkout@v6\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n>     - run: ci/install-dependencies.sh\n>     - run: ci/run-static-analysis.sh\n>     - run: ci/check-directional-formatting.bash\n> @@ -505,7 +505,7 @@ jobs:\n>       group: rust-analysis-${{ github.ref }}\n>       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n>     steps:\n> -    - uses: actions/checkout@v6\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n>     - run: ci/install-dependencies.sh\n>     - run: ci/run-rust-checks.sh\n>   sparse:\n> @@ -519,7 +519,7 @@ jobs:\n>       group: sparse-${{ github.ref }}\n>       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n>     steps:\n> -    - uses: actions/checkout@v6\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n>     - name: Install other dependencies\n>       run: ci/install-dependencies.sh\n>     - run: make sparse\n> @@ -535,6 +535,6 @@ jobs:\n>       CI_JOB_IMAGE: ubuntu-latest\n>     runs-on: ubuntu-latest\n>     steps:\n> -    - uses: actions/checkout@v6\n> +    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n>     - run: ci/install-dependencies.sh\n>     - run: ci/test-documentation.sh\n> \n> base-commit: d46921825429c74931372567941eaf98d4483210\n> --\n> 2.56.0.187.g9e9ae442333\n> \n\n"},{"id":"556115","messageId":"xmqqbj8k3xcy.fsf@gitster.g","threadId":"66647","inReplyTo":"a178dde02a80324d4cb52781d542ee575cbb68a1.1792773333.git.ttaylorr@openai.com","subject":"Re: [PATCH] ci: pin actions in the main workflow to full commit IDs","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2026-10-23T21:45:01Z","receivedAt":"2026-10-23T21:45:01Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Taylor Blau <ttaylorr@openai.com> writes:\n\n> Some forks are hosted by organizations that restrict which GitHub\n> Actions may run, including requiring actions to be pinned to full\n> commit IDs. Our main CI workflow refers to actions by version tags or\n> branches, which prevents it from running under such a policy.\n\nI do not see why the limitations of other organizations should\naffect our workflow here.  What if another organization prefers\nreadable and concise tag names?  Would they send a patch to revert\nthis change, leading to a \"last one wins\" situation?\n\nWould it be too much trouble for organizations with this specific\nrequirement to maintain such changes in their own forks?  When we\nneed to update a dependency (for example, when 'checkout@v6' is\ndeprecated and we transition to 'checkout@v7'), it would result in a\nconflict anyway.  At that point, someone has to translate the\nsymbolic name to a full object name.  It seems only fair that the\norganizations requiring this level of pinning handle that\ntranslation themselves, and the conflict will tell them exactly\nwhich line has the symbolic name that needs to be translated to a\nfull object name.\n\n"},{"id":"556130","messageId":"atv8gYf8Le1WHTA0@com-79390","threadId":"66647","inReplyTo":"xmqqbj8k3xcy.fsf@gitster.g","subject":"Re: [PATCH] ci: pin actions in the main workflow to full commit IDs","fromName":"Taylor Blau","fromEmail":"ttaylorr@openai.com","sentAt":"2026-10-24T00:32:02Z","receivedAt":"2026-10-24T00:32:02Z","isPatch":true,"sender":{"key":"me@ttaylorr.com","avatar":"https://avatars.githubusercontent.com/u/301000140?v=4"},"body":"On Fri, Oct 23, 2026 at 02:45:01PM -0700, Junio C Hamano wrote:\n> Taylor Blau <ttaylorr@openai.com> writes:\n>\n> > Some forks are hosted by organizations that restrict which GitHub\n> > Actions may run, including requiring actions to be pinned to full\n> > commit IDs. Our main CI workflow refers to actions by version tags or\n> > branches, which prevents it from running under such a policy.\n>\n> I do not see why the limitations of other organizations should\n> affect our workflow here.  What if another organization prefers\n> readable and concise tag names?  Would they send a patch to revert\n> this change, leading to a \"last one wins\" situation?\n\nI see what you're saying, but I think in this particular case there *is*\na good reason to do this in your tree.\n\nThese actions are executable dependencies of our CI, so if a malicious\nactor points, say, checkout@v6 at something which modifies code in the\ntree, we are relying entirely on the permissions of CI's configured\n$GITHUB_TOKEN to save us from code injection.\n\nThere is maintenance involved, including deliberately picking up bug\nand security fixes within a major version. But using a tag does not\neliminate the decision about which code to execute; it delegates that\ndecision to whoever can update the tag. I think making those updates\nexplicit in our repository is worth the maintenance.\n\nKeeping a downstream patch is certainly possible. But having each fork\nrepeat the same translation leaves the upstream workflow without that\nprotection and duplicates the work. That is why I think this belongs\nupstream.\n\nI think that we could reword the commit message to explain that benefit\nmore clearly, but I do think this is the right policy.\n\n> Would it be too much trouble for organizations with this specific\n> requirement to maintain such changes in their own forks?\n\nJust as a concrete example, before submitting patches out of openai/git,\nI apply this patch on top of my branch, then run CI, and then remove the\nextraneous commit before sending. This happens on every topic, and\nAFAICT this is not an uncommon restriction among other corporate\norganization accounts on GitHub.\n\nThanks,\nTaylor\n\n"},{"id":"556132","messageId":"xmqqzew327zf.fsf@gitster.g","threadId":"66647","inReplyTo":"atv8gYf8Le1WHTA0@com-79390","subject":"Re: [PATCH] ci: pin actions in the main workflow to full commit IDs","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2026-10-24T01:38:28Z","receivedAt":"2026-10-24T01:38:28Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Taylor Blau <ttaylorr@openai.com> writes:\n\n> I think that we could reword the commit message to explain that benefit\n> more clearly, but I do think this is the right policy.\n\nTogether with Ben Knoble's comments, I very much appreciate your\npushing back.  I agree that a different justification would be a\ngood way to go.\n\nThanks.\n\n"},{"id":"556386","messageId":"67057c2277e38a675ffbe0206bf249c24efdd6b6.1793038091.git.ttaylorr@openai.com","threadId":"66647","inReplyTo":"a178dde02a80324d4cb52781d542ee575cbb68a1.1792773333.git.ttaylorr@openai.com","subject":"[PATCH v2] ci: pin actions in the main workflow to full commit IDs","fromName":"Taylor Blau","fromEmail":"ttaylorr@openai.com","sentAt":"2026-10-26T18:08:30Z","receivedAt":"2026-10-26T18:08:30Z","isPatch":true,"sender":{"key":"me@ttaylorr.com","avatar":"https://avatars.githubusercontent.com/u/301000140?v=4"},"body":"Our main CI workflow refers to actions by version tags. These tags can\nmove, changing the action code we run without any change to our\nrepository. If an attacker gains access to an action's repository,\nthey can move an existing tag to a malicious revision and have our\nworkflow pick it up automatically.\n\nPin these actions to full commit IDs so that moving a tag cannot\nsubstitute a different action revision. Updating the actions will\nrequire an explicit change to our workflow, including when picking up\nbug fixes and security fixes within a major version.\n\nRetain the version names in comments to keep the references readable\nand make future updates easier to review.\n\nSigned-off-by: Taylor Blau <ttaylorr@openai.com>\n---\n .github/workflows/main.yml | 64 +++++++++++++++++++-------------------\n 1 file changed, 32 insertions(+), 32 deletions(-)\n\ndiff --git a/.github/workflows/main.yml b/.github/workflows/main.yml\nindex fe8155772ab..ba0b5ffb634 100644\n--- a/.github/workflows/main.yml\n+++ b/.github/workflows/main.yml\n@@ -65,7 +65,7 @@ jobs:\n           echo \"skip_concurrent=$skip_concurrent\" >>$GITHUB_OUTPUT\n       - name: skip if the commit or tree was already tested\n         id: skip-if-redundant\n-        uses: actions/github-script@v9\n+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9\n         if: steps.check-ref.outputs.enabled == 'yes'\n         with:\n           github-token: ${{secrets.GITHUB_TOKEN}}\n@@ -114,8 +114,8 @@ jobs:\n       group: windows-build-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n-    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n     - name: Install GCC-compatible Rust target\n       shell: bash\n       run: |\n@@ -149,7 +149,7 @@ jobs:\n     - name: zip up tracked files\n       run: git archive -o artifacts/tracked.tar.gz HEAD\n     - name: upload tracked files and build artifacts\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: windows-artifacts\n         path: artifacts\n@@ -166,14 +166,14 @@ jobs:\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n     - name: download tracked files and build artifacts\n-      uses: actions/download-artifact@v8\n+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\n       with:\n         name: windows-artifacts\n         path: ${{github.workspace}}\n     - name: extract tracked files and build artifacts\n       shell: bash\n       run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz\n-    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n     - name: test\n       shell: bash\n       run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10\n@@ -183,7 +183,7 @@ jobs:\n       run: ci/print-test-failures.sh\n     - name: Upload failed tests' directories\n       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: failed-tests-windows-${{ matrix.nr }}\n         path: ${{env.FAILED_TEST_ARTIFACTS}}\n@@ -199,20 +199,20 @@ jobs:\n       group: vs-build-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n-    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n     - name: initialize vcpkg\n-      uses: actions/checkout@v6\n+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n       with:\n         repository: 'microsoft/vcpkg'\n         path: 'compat/vcbuild/vcpkg'\n     - name: download vcpkg artifacts\n-      uses: git-for-windows/get-azure-pipelines-artifact@v0\n+      uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0\n       with:\n         repository: git/git\n         definitionId: 9\n     - name: add msbuild to PATH\n-      uses: microsoft/setup-msbuild@v3\n+      uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3\n     - name: copy dlls to root\n       shell: cmd\n       run: compat\\vcbuild\\vcpkg_copy_dlls.bat release\n@@ -234,7 +234,7 @@ jobs:\n     - name: zip up tracked files\n       run: git archive -o artifacts/tracked.tar.gz HEAD\n     - name: upload tracked files and build artifacts\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: vs-artifacts\n         path: artifacts\n@@ -250,9 +250,9 @@ jobs:\n       group: vs-test-${{ matrix.nr }}-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: git-for-windows/setup-git-for-windows-sdk@v2\n+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2\n     - name: download tracked files and build artifacts\n-      uses: actions/download-artifact@v8\n+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\n       with:\n         name: vs-artifacts\n         path: ${{github.workspace}}\n@@ -270,7 +270,7 @@ jobs:\n       run: ci/print-test-failures.sh\n     - name: Upload failed tests' directories\n       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: failed-tests-windows-vs-${{ matrix.nr }}\n         path: ${{env.FAILED_TEST_ARTIFACTS}}\n@@ -284,8 +284,8 @@ jobs:\n       group: windows-meson-build-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n-    - uses: actions/setup-python@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6\n     - name: Set up dependencies\n       shell: pwsh\n       run: pip install meson ninja\n@@ -296,7 +296,7 @@ jobs:\n       shell: pwsh\n       run: meson compile -C build\n     - name: Upload build artifacts\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: windows-meson-artifacts\n         path: build\n@@ -312,13 +312,13 @@ jobs:\n       group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n-    - uses: actions/setup-python@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6\n     - name: Set up dependencies\n       shell: pwsh\n       run: pip install meson ninja\n     - name: Download build artifacts\n-      uses: actions/download-artifact@v8\n+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8\n       with:\n         name: windows-meson-artifacts\n         path: build\n@@ -331,7 +331,7 @@ jobs:\n       run: ci/print-test-failures.sh\n     - name: Upload failed tests' directories\n       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: failed-tests-windows-meson-${{ matrix.nr }}\n         path: ${{env.FAILED_TEST_ARTIFACTS}}\n@@ -367,7 +367,7 @@ jobs:\n       TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t\n     runs-on: ${{matrix.vector.pool}}\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: ci/run-build-and-tests.sh\n     - name: print test failures\n@@ -375,7 +375,7 @@ jobs:\n       run: ci/print-test-failures.sh\n     - name: Upload failed tests' directories\n       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: failed-tests-${{matrix.vector.jobname}}\n         path: ${{env.FAILED_TEST_ARTIFACTS}}\n@@ -388,7 +388,7 @@ jobs:\n       CI_JOB_IMAGE: ubuntu-latest\n     runs-on: ubuntu-latest\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: ci/run-build-and-minimal-fuzzers.sh\n   dockerized:\n@@ -464,7 +464,7 @@ jobs:\n         else\n           apt-get -q update && apt-get -q -y install git\n         fi\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: useradd builder --create-home\n     - run: chown -R builder .\n@@ -474,7 +474,7 @@ jobs:\n       run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh\n     - name: Upload failed tests' directories\n       if: failure() && env.FAILED_TEST_ARTIFACTS != ''\n-      uses: actions/upload-artifact@v7\n+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7\n       with:\n         name: failed-tests-${{matrix.vector.jobname}}\n         path: ${{env.FAILED_TEST_ARTIFACTS}}\n@@ -489,7 +489,7 @@ jobs:\n       group: static-analysis-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: ci/run-static-analysis.sh\n     - run: ci/check-directional-formatting.bash\n@@ -505,7 +505,7 @@ jobs:\n       group: rust-analysis-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: ci/run-rust-checks.sh\n   sparse:\n@@ -519,7 +519,7 @@ jobs:\n       group: sparse-${{ github.ref }}\n       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - name: Install other dependencies\n       run: ci/install-dependencies.sh\n     - run: make sparse\n@@ -535,6 +535,6 @@ jobs:\n       CI_JOB_IMAGE: ubuntu-latest\n     runs-on: ubuntu-latest\n     steps:\n-    - uses: actions/checkout@v6\n+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6\n     - run: ci/install-dependencies.sh\n     - run: ci/test-documentation.sh\n\nRange-diff against v1:\n1:  a178dde02a8 ! 1:  67057c2277e ci: pin actions in the main workflow to full commit IDs\n    @@ Metadata\n      ## Commit message ##\n         ci: pin actions in the main workflow to full commit IDs\n     \n    -    Some forks are hosted by organizations that restrict which GitHub\n    -    Actions may run, including requiring actions to be pinned to full\n    -    commit IDs. Our main CI workflow refers to actions by version tags or\n    -    branches, which prevents it from running under such a policy.\n    +    Our main CI workflow refers to actions by version tags. These tags can\n    +    move, changing the action code we run without any change to our\n    +    repository. If an attacker gains access to an action's repository,\n    +    they can move an existing tag to a malicious revision and have our\n    +    workflow pick it up automatically.\n     \n    -    Pin those actions to full commit IDs, retaining the version names in\n    -    comments to make future updates easier to review.\n    +    Pin these actions to full commit IDs so that moving a tag cannot\n    +    substitute a different action revision. Updating the actions will\n    +    require an explicit change to our workflow, including when picking up\n    +    bug fixes and security fixes within a major version.\n    +\n    +    Retain the version names in comments to keep the references readable\n    +    and make future updates easier to review.\n     \n         Signed-off-by: Taylor Blau <ttaylorr@openai.com>\n     \n\nbase-commit: d46921825429c74931372567941eaf98d4483210\n-- \n2.56.0.187.g9e9ae442333\n\n"},{"id":"556388","messageId":"xmqq7bj4qq6i.fsf@gitster.g","threadId":"66647","inReplyTo":"67057c2277e38a675ffbe0206bf249c24efdd6b6.1793038091.git.ttaylorr@openai.com","subject":"Re: [PATCH v2] ci: pin actions in the main workflow to full commit IDs","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2026-10-26T18:20:37Z","receivedAt":"2026-10-26T18:20:37Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Taylor Blau <ttaylorr@openai.com> writes:\n\n> Our main CI workflow refers to actions by version tags. These tags can\n> move, changing the action code we run without any change to our\n> repository. If an attacker gains access to an action's repository,\n> they can move an existing tag to a malicious revision and have our\n> workflow pick it up automatically.\n>\n> Pin these actions to full commit IDs so that moving a tag cannot\n> substitute a different action revision. Updating the actions will\n> require an explicit change to our workflow, including when picking up\n> bug fixes and security fixes within a major version.\n>\n> Retain the version names in comments to keep the references readable\n> and make future updates easier to review.\n>\n> Signed-off-by: Taylor Blau <ttaylorr@openai.com>\n> ---\n>  .github/workflows/main.yml | 64 +++++++++++++++++++-------------------\n>  1 file changed, 32 insertions(+), 32 deletions(-)\n\nWith these changes, the proposal no longer appears to bend the\npublic version to suit a single employee's environment.  We might\neven want to strengthen the reasoning by adding \"becoming the\nde facto security standard\", borrowing from Ben Knoble's comment in\nthe previous round.\n\nThanks.  Queued.\n\n\n"}]}