From: Ben Knoble Date: Fri, 23 Oct 2026 18:05:00 GMT Subject: Re: [PATCH] ci: pin actions in the main workflow to full commit IDs Message-ID: In-Reply-To: > Le 23 oct. 2026 à 12:41, Taylor Blau a écrit : > > Some forks are hosted by organizations that restrict which GitHub > Actions may run, including requiring actions to be pinned to full > commit IDs. Our main CI workflow refers to actions by version tags or > branches, which prevents it from running under such a policy. Yep. This is becoming de facto security standard. Perhaps we should say so? « Pinned commit IDs prevent attacks on CI and any secrets stored therein by compromised action suppliers » or something? > Pin those actions to full commit IDs, retaining the version names in > comments to make future updates easier to review. > > Signed-off-by: Taylor Blau > --- > This is based on a merge of 'ps/ci-housekeeping-and-modernizations' > and 'jk/http-curl-strip-creds'. The latter is needed for the HTTP > auth tests to pass with the curl versions in current CI. > > .github/workflows/main.yml | 64 +++++++++++++++++++------------------- > 1 file changed, 32 insertions(+), 32 deletions(-) > > diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml > index fe8155772ab..ba0b5ffb634 100644 > --- a/.github/workflows/main.yml > +++ b/.github/workflows/main.yml > @@ -65,7 +65,7 @@ jobs: > echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT > - name: skip if the commit or tree was already tested > id: skip-if-redundant > - uses: actions/github-script@v9 > + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 > if: steps.check-ref.outputs.enabled == 'yes' > with: > github-token: ${{secrets.GITHUB_TOKEN}} > @@ -114,8 +114,8 @@ jobs: > group: windows-build-${{ github.ref }} > cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} > steps: > - - uses: actions/checkout@v6 > - - uses: git-for-windows/setup-git-for-windows-sdk@v2 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 > - name: Install GCC-compatible Rust target > shell: bash > run: | > @@ -149,7 +149,7 @@ jobs: > - name: zip up tracked files > run: git archive -o artifacts/tracked.tar.gz HEAD > - name: upload tracked files and build artifacts > - uses: actions/upload-artifact@v7 > + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 > with: > name: windows-artifacts > path: artifacts > @@ -166,14 +166,14 @@ jobs: > cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} > steps: > - name: download tracked files and build artifacts > - uses: actions/download-artifact@v8 > + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 > with: > name: windows-artifacts > path: ${{github.workspace}} > - name: extract tracked files and build artifacts > shell: bash > run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz > - - uses: git-for-windows/setup-git-for-windows-sdk@v2 > + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 > - name: test > shell: bash > run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10 > @@ -183,7 +183,7 @@ jobs: > run: ci/print-test-failures.sh > - name: Upload failed tests' directories > if: failure() && env.FAILED_TEST_ARTIFACTS != '' > - uses: actions/upload-artifact@v7 > + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 > with: > name: failed-tests-windows-${{ matrix.nr }} > path: ${{env.FAILED_TEST_ARTIFACTS}} > @@ -199,20 +199,20 @@ jobs: > group: vs-build-${{ github.ref }} > cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} > steps: > - - uses: actions/checkout@v6 > - - uses: git-for-windows/setup-git-for-windows-sdk@v2 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 > - name: initialize vcpkg > - uses: actions/checkout@v6 > + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > with: > repository: 'microsoft/vcpkg' > path: 'compat/vcbuild/vcpkg' > - name: download vcpkg artifacts > - uses: git-for-windows/get-azure-pipelines-artifact@v0 > + uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0 > with: > repository: git/git > definitionId: 9 > - name: add msbuild to PATH > - uses: microsoft/setup-msbuild@v3 > + uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3 > - name: copy dlls to root > shell: cmd > run: compat\vcbuild\vcpkg_copy_dlls.bat release > @@ -234,7 +234,7 @@ jobs: > - name: zip up tracked files > run: git archive -o artifacts/tracked.tar.gz HEAD > - name: upload tracked files and build artifacts > - uses: actions/upload-artifact@v7 > + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 > with: > name: vs-artifacts > path: artifacts > @@ -250,9 +250,9 @@ jobs: > group: vs-test-${{ matrix.nr }}-${{ github.ref }} > cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} > steps: > - - uses: git-for-windows/setup-git-for-windows-sdk@v2 > + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2 > - name: download tracked files and build artifacts > - uses: actions/download-artifact@v8 > + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 > with: > name: vs-artifacts > path: ${{github.workspace}} > @@ -270,7 +270,7 @@ jobs: > run: ci/print-test-failures.sh > - name: Upload failed tests' directories > if: failure() && env.FAILED_TEST_ARTIFACTS != '' > - uses: actions/upload-artifact@v7 > + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 > with: > name: failed-tests-windows-vs-${{ matrix.nr }} > path: ${{env.FAILED_TEST_ARTIFACTS}} > @@ -284,8 +284,8 @@ jobs: > group: windows-meson-build-${{ github.ref }} > cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} > steps: > - - uses: actions/checkout@v6 > - - uses: actions/setup-python@v6 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 > - name: Set up dependencies > shell: pwsh > run: pip install meson ninja > @@ -296,7 +296,7 @@ jobs: > shell: pwsh > run: meson compile -C build > - name: Upload build artifacts > - uses: actions/upload-artifact@v7 > + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 > with: > name: windows-meson-artifacts > path: build > @@ -312,13 +312,13 @@ jobs: > group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }} > cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} > steps: > - - uses: actions/checkout@v6 > - - uses: actions/setup-python@v6 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 > - name: Set up dependencies > shell: pwsh > run: pip install meson ninja > - name: Download build artifacts > - uses: actions/download-artifact@v8 > + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 > with: > name: windows-meson-artifacts > path: build > @@ -331,7 +331,7 @@ jobs: > run: ci/print-test-failures.sh > - name: Upload failed tests' directories > if: failure() && env.FAILED_TEST_ARTIFACTS != '' > - uses: actions/upload-artifact@v7 > + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 > with: > name: failed-tests-windows-meson-${{ matrix.nr }} > path: ${{env.FAILED_TEST_ARTIFACTS}} > @@ -367,7 +367,7 @@ jobs: > TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t > runs-on: ${{matrix.vector.pool}} > steps: > - - uses: actions/checkout@v6 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > - run: ci/install-dependencies.sh > - run: ci/run-build-and-tests.sh > - name: print test failures > @@ -375,7 +375,7 @@ jobs: > run: ci/print-test-failures.sh > - name: Upload failed tests' directories > if: failure() && env.FAILED_TEST_ARTIFACTS != '' > - uses: actions/upload-artifact@v7 > + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 > with: > name: failed-tests-${{matrix.vector.jobname}} > path: ${{env.FAILED_TEST_ARTIFACTS}} > @@ -388,7 +388,7 @@ jobs: > CI_JOB_IMAGE: ubuntu-latest > runs-on: ubuntu-latest > steps: > - - uses: actions/checkout@v6 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > - run: ci/install-dependencies.sh > - run: ci/run-build-and-minimal-fuzzers.sh > dockerized: > @@ -464,7 +464,7 @@ jobs: > else > apt-get -q update && apt-get -q -y install git > fi > - - uses: actions/checkout@v6 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > - run: ci/install-dependencies.sh > - run: useradd builder --create-home > - run: chown -R builder . > @@ -474,7 +474,7 @@ jobs: > run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh > - name: Upload failed tests' directories > if: failure() && env.FAILED_TEST_ARTIFACTS != '' > - uses: actions/upload-artifact@v7 > + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 > with: > name: failed-tests-${{matrix.vector.jobname}} > path: ${{env.FAILED_TEST_ARTIFACTS}} > @@ -489,7 +489,7 @@ jobs: > group: static-analysis-${{ github.ref }} > cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} > steps: > - - uses: actions/checkout@v6 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > - run: ci/install-dependencies.sh > - run: ci/run-static-analysis.sh > - run: ci/check-directional-formatting.bash > @@ -505,7 +505,7 @@ jobs: > group: rust-analysis-${{ github.ref }} > cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} > steps: > - - uses: actions/checkout@v6 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > - run: ci/install-dependencies.sh > - run: ci/run-rust-checks.sh > sparse: > @@ -519,7 +519,7 @@ jobs: > group: sparse-${{ github.ref }} > cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }} > steps: > - - uses: actions/checkout@v6 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > - name: Install other dependencies > run: ci/install-dependencies.sh > - run: make sparse > @@ -535,6 +535,6 @@ jobs: > CI_JOB_IMAGE: ubuntu-latest > runs-on: ubuntu-latest > steps: > - - uses: actions/checkout@v6 > + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 > - run: ci/install-dependencies.sh > - run: ci/test-documentation.sh > > base-commit: d46921825429c74931372567941eaf98d4483210 > -- > 2.56.0.187.g9e9ae442333 >