ci: pin GitHub Actions to commit SHA - #336
Open
sobhe-Starkware wants to merge 4 commits into
Open
Conversation
Pin every third-party action to a full-length commit SHA, with the previous tag or branch kept as a trailing comment for readability. This prevents a mutable tag or branch from being repointed at malicious code upstream, per the GitHub Actions supply chain hardening guidance.
The workspace denies warnings and unused code, so lints new in rustc/cargo 1.97.1 are hard build errors rather than warnings. - Cargo.lock: bump ethnum 1.5.0 -> 1.5.3. 1.5.0 fails to compile with E0512 (transmute between types of different sizes). Cargo.toml already permits it via its caret range. The newer cargo also rewrote the lockfile to format version 4, which needs Cargo 1.78+. - node_serde.rs: allow(dead_code) on LeafCompiledClassToSerialize, which is never constructed. Suppressed rather than deleted because it documents an existing storage layout; whether it should still exist is a separate question. - tree.rs: use values() instead of iter() with a discarded key (clippy::iter_kv_map). - create_tree.rs: drop redundant into_iter() in zip (clippy::useless_conversion). - create_tree_helper.rs: add a blank doc line so the trailing note is its own paragraph rather than a lazy list continuation (clippy::doc_lazy_continuation). - python_tests.rs: remove unused `use log::error`; the one call site uses the fully-qualified log::error!. No behaviour change: no logic, serialization format, or public API is affected. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Records the reasoning behind this branch so it survives review and later archaeology: - why every action is pinned to a full commit SHA: tags and branch refs are mutable, and these jobs hand GCS write credentials and a Codecov token to third-party actions - why seven actions were upgraded rather than pinned at their existing version: old majors bundle retired Node runtimes or, for codecov-action v3, a shut-down uploader, so pinning them as-is would have frozen a broken CI - what each toolchain fix resolves, with the specific error behind it Also flags that the gcs-push job still targets the retired ubuntu-20.04 runner, which is left for a separate commit since it is a runner change rather than an action pin. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #336 +/- ##
==========================================
+ Coverage 70.03% 71.53% +1.49%
==========================================
Files 38 28 -10
Lines 2109 1939 -170
Branches 2109 1939 -170
==========================================
- Hits 1477 1387 -90
+ Misses 562 503 -59
+ Partials 70 49 -21 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin every third-party action to a full-length commit SHA, with the previous tag or branch kept as a trailing comment for readability.
This prevents a mutable tag or branch from being repointed at malicious code upstream, per the GitHub Actions supply chain hardening guidance.