From 16ff274ce10e24177a47aa85478040198c6cf2de Mon Sep 17 00:00:00 2001 From: gnbm Date: Mon, 20 Jul 2026 19:37:28 +0100 Subject: [PATCH] ci(github): pin third-party actions to commit SHAs (FW-6928) Pin all remaining unpinned third-party GitHub Actions to full-length commit SHAs (with a # vX.Y.Z comment) to harden the CI/CD supply chain against a compromised upstream tag being repointed to malicious code. Each action keeps its current major version, pinned to the latest patch of that major (SHA verified against the upstream tag): - actions/setup-node -> v7.0.0 (matches existing repo pins) - actions/upload-artifact -> v7.0.1 - actions/download-artifact -> v8.0.1 - github/codeql-action -> v4.37.1 (init + analyze, same SHA) - amannn/action-semantic-pull-request -> v6.1.1 - actions/labeler -> v6.2.0 Local ./ composite/reusable refs are unchanged (same-repo, no external supply-chain risk). --- .github/workflows/actions/build-angular/action.yml | 2 +- .github/workflows/actions/download-archive/action.yml | 2 +- .github/workflows/actions/test-core-screenshot/action.yml | 2 +- .../workflows/actions/update-reference-screenshots/action.yml | 2 +- .github/workflows/actions/upload-archive/action.yml | 2 +- .github/workflows/codeql-analysis.yml | 4 ++-- .github/workflows/conventional-commit.yml | 2 +- .github/workflows/label.yml | 2 +- 8 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/actions/build-angular/action.yml b/.github/workflows/actions/build-angular/action.yml index 9f27f79336a..12e1db1f5dc 100644 --- a/.github/workflows/actions/build-angular/action.yml +++ b/.github/workflows/actions/build-angular/action.yml @@ -3,7 +3,7 @@ description: 'Build Ionic Angular' runs: using: 'composite' steps: - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x - uses: ./.github/workflows/actions/download-archive diff --git a/.github/workflows/actions/download-archive/action.yml b/.github/workflows/actions/download-archive/action.yml index 2acddf9713f..97f07f8627a 100644 --- a/.github/workflows/actions/download-archive/action.yml +++ b/.github/workflows/actions/download-archive/action.yml @@ -10,7 +10,7 @@ inputs: runs: using: 'composite' steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/.github/workflows/actions/test-core-screenshot/action.yml b/.github/workflows/actions/test-core-screenshot/action.yml index 35eca3ec53e..379ce934edc 100644 --- a/.github/workflows/actions/test-core-screenshot/action.yml +++ b/.github/workflows/actions/test-core-screenshot/action.yml @@ -66,7 +66,7 @@ runs: working-directory: ./core - name: 📦 Archive Updated Screenshots if: inputs.update == 'true' && steps.test-and-update.outputs.hasUpdatedScreenshots == 'true' - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: updated-screenshots-${{ inputs.shard }}-${{ inputs.totalShards }} path: UpdatedScreenshots-${{ inputs.shard }}-${{ inputs.totalShards }}.zip diff --git a/.github/workflows/actions/update-reference-screenshots/action.yml b/.github/workflows/actions/update-reference-screenshots/action.yml index a7bdde53871..844f4e6d2ac 100644 --- a/.github/workflows/actions/update-reference-screenshots/action.yml +++ b/.github/workflows/actions/update-reference-screenshots/action.yml @@ -10,7 +10,7 @@ runs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24.x - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: path: ./artifacts - name: 🔎 Extract Archives diff --git a/.github/workflows/actions/upload-archive/action.yml b/.github/workflows/actions/upload-archive/action.yml index c09397345f9..3cfff8853fc 100644 --- a/.github/workflows/actions/upload-archive/action.yml +++ b/.github/workflows/actions/upload-archive/action.yml @@ -13,7 +13,7 @@ runs: - name: 🗄️ Create Archive run: zip -q -r ${{ inputs.output }} ${{ inputs.paths }} shell: bash - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: ${{ inputs.name }} path: ${{ inputs.output }} diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index ccdc9b996d2..74f504e7317 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -15,7 +15,7 @@ jobs: security-events: write steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 with: languages: javascript - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml index 8c0bbdebb37..65c026de5eb 100644 --- a/.github/workflows/conventional-commit.yml +++ b/.github/workflows/conventional-commit.yml @@ -12,7 +12,7 @@ jobs: if: | !contains(github.event.pull_request.title, 'release') && !contains(github.event.pull_request.title, 'chore') - uses: amannn/action-semantic-pull-request@v6 + uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml index 7f5d8de9787..b6014addef1 100644 --- a/.github/workflows/label.yml +++ b/.github/workflows/label.yml @@ -13,7 +13,7 @@ jobs: triage: runs-on: ubuntu-latest steps: - - uses: actions/labeler@v6 + - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0 with: repo-token: "${{ secrets.GITHUB_TOKEN }}" sync-labels: true