Re: [PATCH] ci: pin actions in the main workflow to full commit IDs

From: Junio C Hamano <gitster@pobox.com>
Date: Oct 23, 2026, 21:45 UTC
Message-ID: <xmqqbj8k3xcy.fsf@gitster.g>
In-Reply-To: <a178dde02a80324d4cb52781d542ee575cbb68a1.1792773333.git.ttaylorr@openai.com>

Taylor Blau <ttaylorr@openai.com> writes:

> Some forks are hosted by organizations that restrict which GitHub
> Actions may run, including requiring actions to be pinned to full
> commit IDs. Our main CI workflow refers to actions by version tags or
> branches, which prevents it from running under such a policy.

I do not see why the limitations of other organizations should affect our workflow here. What if another organization prefers readable and concise tag names? Would they send a patch to revert this change, leading to a "last one wins" situation?

Would it be too much trouble for organizations with this specific requirement to maintain such changes in their own forks? When we need to update a dependency (for example, when 'checkout@v6' is deprecated and we transition to 'checkout@v7'), it would result in a conflict anyway. At that point, someone has to translate the symbolic name to a full object name. It seems only fair that the organizations requiring this level of pinning handle that translation themselves, and the conflict will tell them exactly which line has the symbolic name that needs to be translated to a full object name.