Conversation
Pin all remaining unpinned third-party GitHub Actions to full-length commit SHAs (with a # vX.Y.Z comment) to harden the CI/CD supply chain against a compromised upstream tag being repointed to malicious code. Each action keeps its current major version, pinned to the latest patch of that major (SHA verified against the upstream tag): - actions/setup-node -> v7.0.0 (matches existing repo pins) - actions/upload-artifact -> v7.0.1 - actions/download-artifact -> v8.0.1 - github/codeql-action -> v4.37.1 (init + analyze, same SHA) - amannn/action-semantic-pull-request -> v6.1.1 - actions/labeler -> v6.2.0 Local ./ composite/reusable refs are unchanged (same-repo, no external supply-chain risk).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
gnbm
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR improves GitHub Actions supply-chain security by pinning third-party uses: references (in workflows and composite actions) to full commit SHAs, with version comments, instead of mutable tags.
Changes:
- Pin remaining third-party GitHub Actions (
actions/*,github/codeql-action,amannn/action-semantic-pull-request) to full commit SHAs with# vX.Y.Zcomments. - Apply the same pinning convention consistently across workflows and reusable/composite actions.
- Keep local
uses: ./...references unchanged (same-repo).
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/actions/build-angular/action.yml | Pins actions/setup-node to a commit SHA for reproducible builds. |
| .github/workflows/actions/upload-archive/action.yml | Pins actions/upload-artifact to a commit SHA for reproducible artifact uploads. |
| .github/workflows/actions/download-archive/action.yml | Pins actions/download-artifact to a commit SHA for reproducible artifact downloads. |
| .github/workflows/actions/update-reference-screenshots/action.yml | Pins actions/download-artifact to a commit SHA for secure artifact retrieval. |
| .github/workflows/actions/test-core-screenshot/action.yml | Pins actions/upload-artifact to a commit SHA for secure artifact publishing. |
| .github/workflows/codeql-analysis.yml | Pins CodeQL init/analyze actions to a commit SHA for stable security scanning. |
| .github/workflows/conventional-commit.yml | Pins amannn/action-semantic-pull-request to a commit SHA for stable PR title validation. |
| .github/workflows/label.yml | Pins actions/labeler to a commit SHA for stable PR labeling. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
gnbm
marked this pull request as ready for review
July 20, 2026 21:54
gnbm
requested review from
ShaneK and
brandyscarney
and removed request for
brandyscarney
July 20, 2026 21:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue number: FW-6928
What is the current behavior?
Several third-party GitHub Actions in our workflows and composite actions
were still referenced by mutable tags (
@v6/@v7/@v8/@v4). A mutabletag can be repointed by the action author — or an attacker who gains write
access to the action repo — to arbitrary code, which then runs with the
workflow's permissions and secrets (notably in the release pipeline).
What is the new behavior?
All remaining unpinned third-party actions are now pinned to a full-length
commit SHA with a
# vX.Y.Zcomment, matching the convention already usedacross the repo (e.g.
actions/checkout@9c091bb… # v7.0.0). Each actionkeeps its current major, pinned to the latest patch of that major. Every
SHA was independently verified against its upstream tag.
Local
uses: ./…composite/reusable refs are intentionally left unchanged(same-repo, no external supply-chain risk).
Does this introduce a breaking change?
No behavioural change — this only pins which upstream commit CI executes.
Other information
unpinned actions, and a
github-actionsDependabot entry to keep the pinsbumped.