From 1335fcc85110e4fc4f26cfb0aa96e121eb3308b9 Mon Sep 17 00:00:00 2001
From: Madelyn Romberg <madelynromberg@g.ucla.edu>
Date: Fri, 4 Jul 2025 16:35:14 +0200
Subject: [PATCH 1/4] chore: pin external GitHub Actions to exact SHAs

---
 .github/workflows/code-quality.yml | 2 +-
 .github/workflows/unit-tests.yml   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index cb00dce..7dcad34 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -12,7 +12,7 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
       - uses: ./.github/actions/install-env
       - name: Run pre-commit on all files
         run: poetry run pre-commit run --all-files
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index c53b79d..a53afcf 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -15,7 +15,7 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
       - uses: ./.github/actions/install-env
         with:
           python-version: ${{ matrix.python-version }}

From 1eae5fd79b331c51d1b5139fd87075b73e13554c Mon Sep 17 00:00:00 2001
From: Madelyn Romberg <madelynromberg@g.ucla.edu>
Date: Wed, 9 Jul 2025 09:57:13 +0200
Subject: [PATCH 2/4] add pre commit hook for pinned actions

---
 .pre-commit-config.yaml |  8 ++++++++
 check_pinned_actions.sh | 21 +++++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 check_pinned_actions.sh

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index aa2a738..ce5f58c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -36,3 +36,11 @@ repos:
     rev: 0.7.1
     hooks:
       - id: nbstripout
+
+  - repo: local
+    hooks:
+      - id: check-external-actions-pinned
+        name: Check GitHub Actions are pinned
+        entry: pre-commit-hooks/check_pinned_actions.sh
+        language: script
+        pass_filenames: false
diff --git a/check_pinned_actions.sh b/check_pinned_actions.sh
new file mode 100644
index 0000000..3791fd4
--- /dev/null
+++ b/check_pinned_actions.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# Only run if .github/ files are staged
+staged_github_files=$(git diff --cached --name-only --diff-filter=ACM | grep '^\.github/')
+if [ -z "$staged_github_files" ]; then
+  exit 0
+fi
+
+# Check for unpinned external GitHub Actions (not using commit SHA)
+offenders=$(echo "$staged_github_files" | grep -E '\.github/(workflows|actions)/' |
+  xargs grep -E "uses:[[:space:]]*[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+@" |
+  grep -v "\.github/actions" |
+  grep -v -E "@[0-9a-f]{40}($|[^0-9a-f])")
+
+if [ -n "$offenders" ]; then
+  echo "❌ Error: Detected external GitHub Actions that are not pinned to a commit SHA." >&2
+  echo "Please update your workflows accordingly to prevent supply chain attacks!" >&2
+  echo "Offending lines:" >&2
+  echo "$offenders" >&2
+  exit 1
+fi
\ No newline at end of file

From 4863a75b59620283bf9fdf90d655485365b7bd5c Mon Sep 17 00:00:00 2001
From: Madelyn Romberg <madelynromberg@g.ucla.edu>
Date: Wed, 9 Jul 2025 10:03:20 +0200
Subject: [PATCH 3/4] move hook into folder

---
 .../check_pinned_actions.sh                                       | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename check_pinned_actions.sh => pre-commit-hooks/check_pinned_actions.sh (100%)

diff --git a/check_pinned_actions.sh b/pre-commit-hooks/check_pinned_actions.sh
similarity index 100%
rename from check_pinned_actions.sh
rename to pre-commit-hooks/check_pinned_actions.sh

From b2dc3753f59d469ecaea04e215982be19c821e33 Mon Sep 17 00:00:00 2001
From: Madelyn Romberg <madelynromberg@g.ucla.edu>
Date: Wed, 9 Jul 2025 10:05:48 +0200
Subject: [PATCH 4/4] make script executable

---
 pre-commit-hooks/check_pinned_actions.sh | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 pre-commit-hooks/check_pinned_actions.sh

diff --git a/pre-commit-hooks/check_pinned_actions.sh b/pre-commit-hooks/check_pinned_actions.sh
old mode 100644
new mode 100755