Pin GitHub Actions to commit SHAs and add Dependabot - #264
Conversation
actions/checkout and actions/setup-python were on mutable major tags, the same exposure the setup-uv pins addressed. The Dependabot config is the half that makes SHA pinning sustainable: it rewrites the SHA and its version comment together, so the workflows track upstream instead of freezing. ord-app and ord-infrastructure show the failure mode -- both are SHA-pinned with no update mechanism, and both sit a major version behind on setup-uv, with one of the two also behind within its own actions/checkout major. Grouped monthly so this is one pull request rather than one per action. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| ref: ${{ env.ORD_SCHEMA_TAG }} | ||
| path: ord-schema | ||
| - uses: actions/setup-python@v5 | ||
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 |
There was a problem hiding this comment.
This SHA identifies an intermediate dependency-update commit rather than the tagged release represented by # v5, so both validation jobs execute an unintended development revision and remain behind the released v5 action fixes until Dependabot replaces the pin.
There was a problem hiding this comment.
This is incorrect — a26af69be951a213d495a4c3e4e4022e16d87065 is the released tag, not an intermediate commit. From the tags API:
actions/setup-python@a26af69b tags=[v5.6.0, v5]
It carries both v5.6.0 and the v5 major tag, so it is the current head of the v5 release line. Every pin in this PR was resolved the same way — via the git refs API, dereferencing annotated tags to their commits — precisely so the pins land on release commits rather than arbitrary revisions.
The comment reads # v5 rather than # v5.6.0 because the pin deliberately reproduces the ref that was already in use, keeping this PR free of behavior changes. Dependabot rewrites both the SHA and that comment on its first run.
🤖 Generated with Claude Code
1 participant
Version tags are mutable. The
tj-actions/changed-filescompromise in March 2025 repointed every version tag at a commit that dumped runner secrets into build logs, hitting roughly 23,000 repositories; tag pinning offered no protection and SHA pinning offered complete protection. This repository's workflows carry credentials worth protecting —HF_TOKENwith write access to the public Hugging Face mirror, and aGITHUB_TOKENthat pushes to submission branches — soactions/checkoutandactions/setup-pythonmove to SHAs, joining thesetup-uvpins from #262 and #263.The Dependabot config is the half that makes this sustainable, and it is not optional. Dependabot understands SHA-pinned actions and rewrites the SHA together with its trailing
# vNcomment, so pinned workflows keep tracking upstream. Without it, pinning silently freezes the workflows on whatever was current the day they were written.That is not hypothetical within this org. ord-app and ord-infrastructure are both fully SHA-pinned with no update mechanism, and both sit on
astral-sh/setup-uvv5.4.2 while this repository and ord-schema run v7. ord-app'sactions/checkoutpin is additionally stale within v4 — it points at a November 2025 commit, whilev4has since moved — and the two repositories disagree with each other on which checkout SHA to use. Companion Dependabot PRs for those two repositories follow.Updates are grouped so this arrives as one pull request a month rather than one per action.
Every pin resolves the tag that was already in use, so nothing changes behavior. The pins were resolved through the git refs API, dereferencing annotated tags to their commits.
Stacked on #263; retargets to
mainas the chain merges.🤖 Generated with Claude Code
Greptile Summary
The PR makes GitHub Actions references immutable and configures monthly grouped updates.
Confidence Score: 4/5
The PR appears safe to merge, though the setup-python SHA should be corrected to the intended tagged v5 release.
Checkout and Dependabot changes preserve their intended behavior, while the setup-python references select an untagged development revision and misleadingly label it as the resolved v5 release.
Files Needing Attention: .github/workflows/validation.yml
Important Files Changed
Reviews (1): Last reviewed commit: "Pin the remaining actions to SHAs and ad..." | Re-trigger Greptile