Repository navigation
chore(ci): pin pr-inspector third-party actions to tagged versions - #23339
Closed
anooparveti wants to merge 1 commit into
Closed
anooparveti wants to merge 1 commit into
anooparveti wants to merge 1 commit into
Conversation
Copilot stopped reviewing on behalf of
anooparveti due to an error
October 28, 2026 13:32
Copilot stopped reviewing on behalf of
anooparveti due to an error
October 28, 2026 13:33
Contributor
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
2 open issues
What changed in this PR
Updates the PR inspection GitHub Actions workflow to use versioned action releases instead of floating branches.
Changes:
- Pin
mschilde/auto-label-merge-conflictsfrommastertov2 - Pin
Simek/yarn-lock-changesfrommaintov0.14.1
| File | Description |
|---|---|
| .github/workflows/pr-inspector.yml | Replaces floating action refs with versioned tags for more predictable workflow runs |
Review effort: Lite
anooparveti
force-pushed
the
chore/pin-pr-inspector-actions
branch
from
October 28, 2026 14:48
71040e7 to
9dd8391
Compare
Replace mutable tag refs for all third-party actions across the workflows with full-length commit SHAs, keeping the human-readable `version as a trailing comment (per GitHub's hardening guidance). Pinned: - TimonVS/pr-labeler-action -> 8b99f40 (v4) - olivernybroe/action-conflict-finder -> 78f7add (v4.0) - mschilde/auto-label-merge-conflicts -> 5981f89 (v2.0) Note: the previously used @v2 ref did not exist upstream (only v2.0 is tagged); the ref was silently resolving to master. Pinning to v2.0's SHA both locks the ref and restores an actual released version. - Simek/yarn-lock-changes -> 59f47ee (v0.14.1) - nrwl/nx-set-shas -> 3e9ad73 (v4) - jlumbroso/free-disk-space -> 54081f1 (v1.3.1) - wagoid/commitlint-github-action -> d524cbd (v4) - repo-sync/pull-request -> 7e79a9f (v2) - peaceiris/actions-gh-pages -> 329bcc8 (v4) First-party actions/* entries are left on tags, as those are maintained by GitHub itself and out of scope for this change. Why: tags are mutable and can be force-moved by an upstream maintainer (or an attacker who compromises their account) to point at arbitrary code that then runs in CI with repository secrets. Pinning to a full commit SHA removes that attack surface and matches GitHub's own security-hardening recommendation for third-party actions. Signed-off-by: Anoop N <anoop.n@ovhcloud.com> Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
anooparveti
force-pushed
the
chore/pin-pr-inspector-actions
branch
from
October 28, 2026 15:24
9dd8391 to
24e67ae
Compare
anooparveti
requested review from
FabienHenon and
clementdemily
and
a balanced review from Copilot
October 28, 2026 15:24
Copilot stopped reviewing on behalf of
anooparveti due to an error
October 28, 2026 15:24
Comment on lines
12
to
+15
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - uses: wagoid/commitlint-github-action@v4 | ||
| - uses: wagoid/commitlint-github-action@d524cbd2fcbd5dcce5ad4ca6733154643ab768da # v4 |
Contributor
Author
|
It has been tackled with #23340 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Replace mutable tag refs for all third-party actions across the
workflows with full-length commit SHAs, keeping the human-readable
`version as a trailing comment (per GitHub's hardening guidance).
Ticket Reference: #...
Additional Information