From a990f0059693870940a89cfce47f7afe368bbce7 Mon Sep 17 00:00:00 2001 From: Patrick Kaeding Date: Mon, 23 Mar 2026 23:24:25 -0400 Subject: [PATCH] [SEC-7924] chore: pin third-party GitHub Actions to commit SHAs Pin all third-party GitHub Actions to full-length commit SHAs to prevent supply chain attacks. Addresses findings from the third-party-action-not-pinned-to-commit-sha Semgrep rule. --- .github/actions/ci/action.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/manual-publish-docs.yml | 2 +- .github/workflows/release-please.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/actions/ci/action.yml b/.github/actions/ci/action.yml index 229d7ac..d0e3e94 100644 --- a/.github/actions/ci/action.yml +++ b/.github/actions/ci/action.yml @@ -8,7 +8,7 @@ inputs: runs: using: composite steps: - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1 with: ruby-version: ${{ inputs.ruby-version }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 996d50a..033b8ed 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,7 +41,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1 with: ruby-version: 3.0 diff --git a/.github/workflows/manual-publish-docs.yml b/.github/workflows/manual-publish-docs.yml index 73b5d22..786f2a6 100644 --- a/.github/workflows/manual-publish-docs.yml +++ b/.github/workflows/manual-publish-docs.yml @@ -11,7 +11,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: ruby/setup-ruby@v1 + - uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1 with: ruby-version: 3.0 diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index ac164c3..7d6fc2c 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -17,7 +17,7 @@ jobs: upload-tag-name: ${{ steps.release.outputs.tag_name }} gem-hash: ${{ steps.publish.outputs.gem-hash}} steps: - - uses: googleapis/release-please-action@v4 + - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4 id: release - uses: actions/checkout@v4