From: Junio C Hamano Date: Mon, 26 Oct 2026 18:20:37 GMT Subject: Re: [PATCH v2] ci: pin actions in the main workflow to full commit IDs Message-ID: In-Reply-To: <67057c2277e38a675ffbe0206bf249c24efdd6b6.1793038091.git.ttaylorr@openai.com> Taylor Blau writes: > Our main CI workflow refers to actions by version tags. These tags can > move, changing the action code we run without any change to our > repository. If an attacker gains access to an action's repository, > they can move an existing tag to a malicious revision and have our > workflow pick it up automatically. > > Pin these actions to full commit IDs so that moving a tag cannot > substitute a different action revision. Updating the actions will > require an explicit change to our workflow, including when picking up > bug fixes and security fixes within a major version. > > Retain the version names in comments to keep the references readable > and make future updates easier to review. > > Signed-off-by: Taylor Blau > --- > .github/workflows/main.yml | 64 +++++++++++++++++++------------------- > 1 file changed, 32 insertions(+), 32 deletions(-) With these changes, the proposal no longer appears to bend the public version to suit a single employee's environment. We might even want to strengthen the reasoning by adding "becoming the de facto security standard", borrowing from Ben Knoble's comment in the previous round. Thanks. Queued.