From 8bb6e04bf970ed069144af65ce45d07e30aa98a3 Mon Sep 17 00:00:00 2001 From: masarray Date: Sun, 12 Jul 2026 06:34:09 +0700 Subject: [PATCH 1/5] Pin CI actions to immutable commits --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2a5675f..d6e5233 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,10 +16,10 @@ jobs: runs-on: windows-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Setup .NET - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: 8.0.4xx From eaa9d8ef7999d52514a7650d21a4343ae800481b Mon Sep 17 00:00:00 2001 From: masarray Date: Sun, 12 Jul 2026 06:34:17 +0700 Subject: [PATCH 2/5] Pin CodeQL actions to immutable commits --- .github/workflows/codeql.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 52c1ee4..ad81454 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,15 +18,15 @@ jobs: runs-on: windows-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Setup .NET - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: 8.0.4xx - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 with: languages: csharp build-mode: manual @@ -38,4 +38,4 @@ jobs: run: dotnet build ARSVIN.sln -c Release --no-restore - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4 From f61138a3923dcc42a51f9b70b2a5f7f4a7dcf148 Mon Sep 17 00:00:00 2001 From: masarray Date: Sun, 12 Jul 2026 06:34:25 +0700 Subject: [PATCH 3/5] Pin Pages actions to immutable commits --- .github/workflows/pages.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 989dac1..db53968 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -27,7 +27,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - name: Validate public site shell: pwsh @@ -40,13 +40,13 @@ jobs: touch site/.nojekyll - name: Configure Pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6 - name: Upload Pages artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5 with: path: site - name: Deploy id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5 From 9c38bde21289cdea691c98729cd9715774ba3b1a Mon Sep 17 00:00:00 2001 From: masarray Date: Sun, 12 Jul 2026 06:35:24 +0700 Subject: [PATCH 4/5] Pin release actions to immutable commits --- .github/workflows/release.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a31ef38..8e5e9a6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -48,12 +48,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: fetch-depth: 0 - name: Setup .NET - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 with: dotnet-version: 8.0.4xx cache: true @@ -266,7 +266,7 @@ jobs: Get-Content (Join-Path $releaseRoot 'SHA256SUMS.txt') - name: Upload release workflow artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: ${{ steps.version.outputs.artifact_name }} path: | @@ -286,13 +286,13 @@ jobs: steps: - name: Download validated release artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: ${{ needs.package.outputs.artifact_name }} path: artifacts/release - name: Create GitHub Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 with: tag_name: ${{ needs.package.outputs.tag_name }} target_commitish: ${{ github.sha }} From 15bda8ccd752c8d97d23f7903cc71165df811f5a Mon Sep 17 00:00:00 2001 From: masarray Date: Sun, 12 Jul 2026 06:35:46 +0700 Subject: [PATCH 5/5] Document immutable GitHub Actions pinning --- CHANGELOG.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7dde80e..bf43120 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,12 +4,17 @@ All notable ARSVIN changes are documented here using a lightweight Keep a Change ## Unreleased +### Security + +- Pinned all GitHub Actions used by CI, CodeQL, Pages, and release workflows to immutable commit SHAs while retaining version comments for maintainability and Dependabot updates. + ### Planned -- Supply-chain pinning for GitHub Actions and installer tooling. +- Exact-version and integrity pinning for installer tooling. - Shared `ARSVIN.Engine` class library extraction. - Code coverage and analyzer quality gates. - Search-indexable HTML engineering documentation. +- SBOM and release provenance/attestation. ## 0.3.0 — 2026-07-11