Repository navigation
ci: SHA-pin first-party actions/* repo-wide (reverses #1022) - #1264
Merged
Merged
Conversation
Pin every remaining floating `uses:` reference to a full commit SHA with a trailing version comment: 52 first-party `actions/*` references plus `sigstore/cosign-installer`, which was on an exact patch tag per #938. All 70 `uses:` lines across the 19 workflow files are now SHA-pinned. #1022 closed on "accept the floats", reasoning that GitHub publishes `actions/*` and also operates the runners. That is the wrong question for a pin to answer: a pin asserts that the ref cannot change under the workflow, not that the publisher is untrusted. A floating major is a mutable ref whoever owns it, and a re-pointed one runs with the workflow's permissions -- the CVE-2025-30066 primitive. Rewrite SECURITY-POSTURE.md's "Action pinning" section from three tiers to a single namespace-blind rule, and restate the accepted consequence honestly in the other direction: SHA pins forgo Dependabot vulnerability *alerts*, which fire only for semver-tag refs, in exchange for immutability and the weekly Dependabot version-update PRs that carry the fix. Update the .github/CLAUDE.md summary to match, per that file's "change the project file first" rule. Behavior-neutral: each floating major resolved to exactly the SHA pinned here at the time of the change, verified via repos/<owner>/<repo>/commits/<major>. Closes all 55 open Code Scanning Pinned-Dependencies alerts. Closes #1263 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015KHE6GoBoSwQwQ3mSDMaM7 Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com>
Deploying genealogix with
|
| Latest commit: |
c44100f
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://83bcd7e8.genealogix.pages.dev |
| Branch Preview URL: | https://ci-sha-pin-first-party-actio.genealogix.pages.dev |
This was referenced Sep 18, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
noahbjohnson
approved these changes
Sep 18, 2026
isaacschepp
added a commit
that referenced
this pull request
Sep 18, 2026
Resolves two SECURITY-POSTURE.md conflicts against #1264, which SHA-pinned first-party actions/* and reversed the #1022 convention: - The "GitHub Actions pinned per a documented convention" row takes main's universal-SHA text; this branch's stale pre-#1264 wording is dropped. - The "Continuous security posture scoring" row keeps main's text plus this branch's pointer to the new Vulnerability suppression section. - The Action pinning section keeps main's syft-installer paragraph, followed by this branch's new "Vulnerability suppression" subsection. #1264 removed the accepted Pinned-Dependencies score ceiling, so the suppression section's and changelog entry's cross-reference to it now points at Action pinning's accepted consequence and known limits instead. Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015KHE6GoBoSwQwQ3mSDMaM7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1263. Reverses the decision in #1022.
What changed
Every remaining floating
uses:reference is now a full commit SHA plus a trailing# vX.Y.Zcomment — 52 first-partyactions/*references andsigstore/cosign-installer, which had been on an exact patch tag per #938. All 70uses:lines across the 19 workflow files are SHA-pinned; there are no exceptions left.Why
#1022 closed this morning on option (a), "accept the floats", reasoning that GitHub publishes
actions/*and also operates the runners, so the publisher is trusted end-to-end.That is the wrong question for a pin to answer. A pin does not assert the publisher is untrustworthy — it asserts that the ref cannot change under the workflow. A floating major is a mutable ref whoever owns it, and a re-pointed one executes with the workflow's permissions: the
tj-actions/changed-filesprimitive (CVE-2025-30066). Ownership of the ref doesn't change that mechanic.Two secondary benefits: any bare
@vNin a workflow diff is now unambiguously a defect (no namespace classification needed at review time), and #928 (zizmor) can land without a per-namespaceunpinned-usesexception config.Source-of-truth ordering
Per
.github/CLAUDE.md's "change the project file first" rule, the substantive change is toSECURITY-POSTURE.md§ Action pinning, rewritten from three tiers to one namespace-blind rule. The.github/CLAUDE.mdsummary was updated afterwards to match, and the Level 2 control row "GitHub Actions pinned per a documented convention" restated.The accepted consequence is restated honestly in the other direction rather than dropped. The old text accepted a Scorecard ceiling; the new text accepts the loss of Dependabot vulnerability alerts, which fire only for semver-tag refs and never for SHA-pinned ones. That is acceptable because the weekly
github-actionsDependabot entry bumps the SHA and rewrites the version comment together, so a patched release arrives as a mergeable PR instead of an alert someone must act on by hand.Behavior-neutral
Each floating major resolved to exactly the SHA pinned here, checked via
repos/<owner>/<repo>/commits/<major>before the edit:actions/checkout3d3c42e5aac5ba805825da76410c181273ba90b1actions/setup-gob7ad1dad31e06c5925ef5d2fc7ad053ef454303eactions/setup-node820762786026740c76f36085b0efc47a31fe5020actions/setup-python5fda3b95a4ea91299a34e894583c3862153e4b97actions/cache55cc8345863c7cc4c66a329aec7e433d2d1c52a9actions/upload-artifact043fb46d1a93c77aae656e7c1c64a875d1fc6a0aactions/download-artifact3e5f45b2cfb9172054b4087a40e8e0b5a5461e7cactions/dependency-review-actiona1d282b36b6f3519aa1f3fc636f609c47dddb294actions/create-github-app-tokenbcd2ba49218906704ab6c1aa796996da409d3eb1sigstore/cosign-installer6f9f17788090df1f26f669e9d70d6ae9567deba6No job runs different code after this PR than before it.
Guardrail preserved
The three actions that publish no floating major (
ossf/scorecard-action#779,mszostok/codeowners-validator,sigstore/cosign-installer#938) keep a trailingdo not "tidy" to @vNnote on theiruses:lines — "correcting" any of them fails withUnable to resolve action.scorecard-actiondid not carry that note before and now does.Verification
uses:references match@[0-9a-f]{40}and carry a version comment.markdownlint-cli2clean across the 68 linted markdown files.Effect on Code Scanning
Closes all 55 open
Pinned-Dependenciesalerts (54 first-party floats + alert 208,release.yml:71). The Scorecard Pinned-Dependencies sub-score for GitHub Actions is no longer capped.🤖 Generated with Claude Code
https://claude.ai/code/session_015KHE6GoBoSwQwQ3mSDMaM7