ci: pin third-party actions to commit SHAs - #88
Conversation
Floating tags can move to broken or malicious commits, as happened with EndBug/add-and-commit v11 (see apify/crawlee#4051). Pin all third-party actions to full commit SHAs with the resolved version tag in a trailing comment. Own-org (apify/*) references stay on floating refs.
| node-version: [18, 20] | ||
| fail-fast: true | ||
| steps: | ||
| - uses: actions/checkout@v3 |
There was a problem hiding this comment.
May we also bump all the actions to their latest compatible versions? Once this is merged, there's no way Renovate (or Dependabot or anyone else) will ever try to update this.
There was a problem hiding this comment.
let me double check, I believe renovate should support this too
There was a problem hiding this comment.
Alright, cool then, I was just making a guess. If it can be updated automatically, I have no further questions :)
There was a problem hiding this comment.
seems you're right, apologies for the noise 👍 https://docs.renovatebot.com/modules/manager/github-actions/#digest-pinning-and-updating
There was a problem hiding this comment.
yeah, both renovate and dependabot supports this shape
on the other hand, looks like we never set up renovate in this repo 🙃 #1 was closed for some reason. and we'd need to update the whitelist of allowed repos, plus we dont enforce min release age here
3 participants
This pins every third-party action in the workflows to a full commit SHA, keeping the resolved version tag as a trailing comment. Renovate understands that convention and updates the SHA and comment together.
Same change as apify/crawlee#4051, rolled out team-wide. The trigger was the
v11tag ofEndBug/add-and-commitmoving to a broken release that failed to load and killed the crawlee publish workflow. With SHA pins, a tag moving under us, by accident or by compromise, can't break or hijack CI anymore. WhereEndBug/add-and-commitis used, it's pinned to v11.0.0, the last working release.Own-org references (
apify/*) stay on floating refs on purpose, since we control those repos.