Pin GitHub Actions to commit SHAs - #441
Merged
Merged
Conversation
Tags and branch refs are mutable pointers. Anyone who can push to an action's
repository can repoint `@v1` — or `@main` — at new code, and every workflow
referencing it picks that up on the next run with no change on our side. A
commit SHA cannot be repointed.
Four references here floated on a branch head rather than any version at all:
actionshub/dco@main
actionshub/get-pr-commits@main
actionshub/yamllint@main
fernandrone/linelint@master
Each pin keeps the version in a trailing `# vX.Y.Z` comment, which is what
Dependabot reads to bump it later. Pins stay inside the major version already
in use, so this is a conversion rather than an upgrade; the `@main` and
`@master` refs move to the latest tagged release, since an untagged commit
gives Dependabot nothing to track.
Also registers the github-actions ecosystem with Dependabot, which previously
tracked only bundler. Without it the new SHA pins would freeze at today's
versions.
The Ruby matrix is left alone. Both the unit and integration matrices already
cover 2.6 through 4.0, which is every released Ruby the gemspec's
`required_ruby_version = ">= 2.6"` permits.
The local `uses: ./.github/workflows/*.yml` references in ci.yml are not
pinned; they resolve within this repository at the same commit.
Signed-off-by: Tim Smith <tsmith84@proton.me>
tpowell-progress
approved these changes
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every third-party action across this repo's five workflows is referenced by a mutable pointer. This converts them all to immutable commit SHAs, with the version preserved in a trailing comment.
The Ruby matrix is untouched. Both the unit and integration matrices already cover 2.6, 2.7, 3.0, 3.1, 3.2, 3.3, 3.4, and 4.0 — every released Ruby the gemspec's
required_ruby_version = ">= 2.6"permits, across ubuntu, macos, and windows. There's nothing to extend here; this repo is already the most thorough of the set.Why pin
A tag is a movable pointer. Anyone who can push to an action's repository can repoint
@v1at new code, and every workflow referencing it picks that up on the next run with no change on our side. A commit SHA can't be repointed.Four references here weren't pinned to a version at all — they floated on a branch head, so every run picks up whatever happened to land on that branch:
Two of those gate DCO sign-off on every PR to this repo.
The pins
actions/checkout@v6d23441a# v6.1.0ruby/setup-ruby@v195ef2b0# v1.321.0r7kamura/rubocop-problem-matchers-action@v159f1a07# v1.2.2wechuli/allcheckspassed@v1e22f45a# v1.2.0DavidAnson/markdownlint-cli2-action@v2207035fd# v22.0.0gaurav-nelson/github-action-markdown-link-check@1.0.173c3b66f# 1.0.17actionshub/dco@main6246515# v2.0.0actionshub/get-pr-commits@main0f1d778# v2.0.0actionshub/yamllint@main00f4f7f# v1.8.3fernandrone/linelint@master7907a5d# 0.0.6This is a conversion, not an upgrade. Each pin resolves to the newest release within the major version already in use, so behavior is unchanged —
checkoutstays on v6 rather than jumping to v7, andmarkdownlint-cli2-actionstays on v22 rather than moving to v24, which would change which rules fire. The@mainand@masterrefs are the one place a version genuinely changes, because there was no version to preserve; those resolve to the latest tagged release, since an untagged commit gives Dependabot nothing to track.The local
uses: ./.github/workflows/lint.ymlandintegration.ymlreferences inci.ymlare intentionally not pinned — they resolve within this repository at the same commit.Dependabot
SHA pins never move on their own, so pinning without automated bumping just trades a supply-chain risk for a staleness one.
dependabot.ymltracked onlybundler, so this registers thegithub-actionsecosystem alongside it. Dependabot reads the trailing# vX.Y.Zcomment to determine the current version and rewrites both the SHA and the comment on each bump.Verification
All five workflow files and
dependabot.ymlparse as valid YAML. Everyuses:reference now resolves either to a 40-character commit SHA or to a local workflow path — verified by grepping for any ref that is neither, which returns nothing.