From: Ben Knoble <ben.knoble@gmail.com>
To: Taylor Blau <ttaylorr@openai.com>
Cc: git@vger.kernel.org, Junio C Hamano <gitster@pobox.com>,
Patrick Steinhardt <ps@pks.im>
Subject: Re: [PATCH] ci: pin actions in the main workflow to full commit IDs
Date: Fri, 23 Oct 2026 14:05:00 -0400 [thread overview]
Message-ID: <CA205F3D-2071-48D5-9986-5FF3F4AB8F68@gmail.com> (raw)
In-Reply-To: <a178dde02a80324d4cb52781d542ee575cbb68a1.1792773333.git.ttaylorr@openai.com>
> Le 23 oct. 2026 à 12:41, Taylor Blau <ttaylorr@openai.com> a écrit :
>
> Some forks are hosted by organizations that restrict which GitHub
> Actions may run, including requiring actions to be pinned to full
> commit IDs. Our main CI workflow refers to actions by version tags or
> branches, which prevents it from running under such a policy.
Yep. This is becoming de facto security standard.
Perhaps we should say so? « Pinned commit IDs prevent attacks
on CI and any secrets stored therein by compromised action suppliers »
or something?
> Pin those actions to full commit IDs, retaining the version names in
> comments to make future updates easier to review.
>
> Signed-off-by: Taylor Blau <ttaylorr@openai.com>
> ---
> This is based on a merge of 'ps/ci-housekeeping-and-modernizations'
> and 'jk/http-curl-strip-creds'. The latter is needed for the HTTP
> auth tests to pass with the curl versions in current CI.
>
> .github/workflows/main.yml | 64 +++++++++++++++++++-------------------
> 1 file changed, 32 insertions(+), 32 deletions(-)
>
> diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
> index fe8155772ab..ba0b5ffb634 100644
> --- a/.github/workflows/main.yml
> +++ b/.github/workflows/main.yml
> @@ -65,7 +65,7 @@ jobs:
> echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT
> - name: skip if the commit or tree was already tested
> id: skip-if-redundant
> - uses: actions/github-script@v9
> + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
> if: steps.check-ref.outputs.enabled == 'yes'
> with:
> github-token: ${{secrets.GITHUB_TOKEN}}
> @@ -114,8 +114,8 @@ jobs:
> group: windows-build-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> - - uses: git-for-windows/setup-git-for-windows-sdk@v2
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
> - name: Install GCC-compatible Rust target
> shell: bash
> run: |
> @@ -149,7 +149,7 @@ jobs:
> - name: zip up tracked files
> run: git archive -o artifacts/tracked.tar.gz HEAD
> - name: upload tracked files and build artifacts
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: windows-artifacts
> path: artifacts
> @@ -166,14 +166,14 @@ jobs:
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - name: download tracked files and build artifacts
> - uses: actions/download-artifact@v8
> + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
> with:
> name: windows-artifacts
> path: ${{github.workspace}}
> - name: extract tracked files and build artifacts
> shell: bash
> run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz
> - - uses: git-for-windows/setup-git-for-windows-sdk@v2
> + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
> - name: test
> shell: bash
> run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10
> @@ -183,7 +183,7 @@ jobs:
> run: ci/print-test-failures.sh
> - name: Upload failed tests' directories
> if: failure() && env.FAILED_TEST_ARTIFACTS != ''
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: failed-tests-windows-${{ matrix.nr }}
> path: ${{env.FAILED_TEST_ARTIFACTS}}
> @@ -199,20 +199,20 @@ jobs:
> group: vs-build-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> - - uses: git-for-windows/setup-git-for-windows-sdk@v2
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
> - name: initialize vcpkg
> - uses: actions/checkout@v6
> + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> with:
> repository: 'microsoft/vcpkg'
> path: 'compat/vcbuild/vcpkg'
> - name: download vcpkg artifacts
> - uses: git-for-windows/get-azure-pipelines-artifact@v0
> + uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0
> with:
> repository: git/git
> definitionId: 9
> - name: add msbuild to PATH
> - uses: microsoft/setup-msbuild@v3
> + uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
> - name: copy dlls to root
> shell: cmd
> run: compat\vcbuild\vcpkg_copy_dlls.bat release
> @@ -234,7 +234,7 @@ jobs:
> - name: zip up tracked files
> run: git archive -o artifacts/tracked.tar.gz HEAD
> - name: upload tracked files and build artifacts
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: vs-artifacts
> path: artifacts
> @@ -250,9 +250,9 @@ jobs:
> group: vs-test-${{ matrix.nr }}-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: git-for-windows/setup-git-for-windows-sdk@v2
> + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
> - name: download tracked files and build artifacts
> - uses: actions/download-artifact@v8
> + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
> with:
> name: vs-artifacts
> path: ${{github.workspace}}
> @@ -270,7 +270,7 @@ jobs:
> run: ci/print-test-failures.sh
> - name: Upload failed tests' directories
> if: failure() && env.FAILED_TEST_ARTIFACTS != ''
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: failed-tests-windows-vs-${{ matrix.nr }}
> path: ${{env.FAILED_TEST_ARTIFACTS}}
> @@ -284,8 +284,8 @@ jobs:
> group: windows-meson-build-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> - - uses: actions/setup-python@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
> - name: Set up dependencies
> shell: pwsh
> run: pip install meson ninja
> @@ -296,7 +296,7 @@ jobs:
> shell: pwsh
> run: meson compile -C build
> - name: Upload build artifacts
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: windows-meson-artifacts
> path: build
> @@ -312,13 +312,13 @@ jobs:
> group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> - - uses: actions/setup-python@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
> - name: Set up dependencies
> shell: pwsh
> run: pip install meson ninja
> - name: Download build artifacts
> - uses: actions/download-artifact@v8
> + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
> with:
> name: windows-meson-artifacts
> path: build
> @@ -331,7 +331,7 @@ jobs:
> run: ci/print-test-failures.sh
> - name: Upload failed tests' directories
> if: failure() && env.FAILED_TEST_ARTIFACTS != ''
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: failed-tests-windows-meson-${{ matrix.nr }}
> path: ${{env.FAILED_TEST_ARTIFACTS}}
> @@ -367,7 +367,7 @@ jobs:
> TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t
> runs-on: ${{matrix.vector.pool}}
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: ci/run-build-and-tests.sh
> - name: print test failures
> @@ -375,7 +375,7 @@ jobs:
> run: ci/print-test-failures.sh
> - name: Upload failed tests' directories
> if: failure() && env.FAILED_TEST_ARTIFACTS != ''
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: failed-tests-${{matrix.vector.jobname}}
> path: ${{env.FAILED_TEST_ARTIFACTS}}
> @@ -388,7 +388,7 @@ jobs:
> CI_JOB_IMAGE: ubuntu-latest
> runs-on: ubuntu-latest
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: ci/run-build-and-minimal-fuzzers.sh
> dockerized:
> @@ -464,7 +464,7 @@ jobs:
> else
> apt-get -q update && apt-get -q -y install git
> fi
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: useradd builder --create-home
> - run: chown -R builder .
> @@ -474,7 +474,7 @@ jobs:
> run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh
> - name: Upload failed tests' directories
> if: failure() && env.FAILED_TEST_ARTIFACTS != ''
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: failed-tests-${{matrix.vector.jobname}}
> path: ${{env.FAILED_TEST_ARTIFACTS}}
> @@ -489,7 +489,7 @@ jobs:
> group: static-analysis-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: ci/run-static-analysis.sh
> - run: ci/check-directional-formatting.bash
> @@ -505,7 +505,7 @@ jobs:
> group: rust-analysis-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: ci/run-rust-checks.sh
> sparse:
> @@ -519,7 +519,7 @@ jobs:
> group: sparse-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - name: Install other dependencies
> run: ci/install-dependencies.sh
> - run: make sparse
> @@ -535,6 +535,6 @@ jobs:
> CI_JOB_IMAGE: ubuntu-latest
> runs-on: ubuntu-latest
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: ci/test-documentation.sh
>
> base-commit: d46921825429c74931372567941eaf98d4483210
> --
> 2.56.0.187.g9e9ae442333
>
next prev parent reply other threads:[~2026-10-23 18:05 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-23 16:38 [PATCH] ci: pin actions in the main workflow to full commit IDs Taylor Blau
2026-10-23 18:05 ` Ben Knoble [this message]
2026-10-23 21:45 ` Junio C Hamano
2026-10-24 0:32 ` Taylor Blau
2026-10-24 1:38 ` Junio C Hamano
2026-10-26 18:08 ` [PATCH v2] " Taylor Blau
2026-10-26 18:20 ` Junio C Hamano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CA205F3D-2071-48D5-9986-5FF3F4AB8F68@gmail.com \
--to=ben.knoble@gmail.com \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
--cc=ps@pks.im \
--cc=ttaylorr@openai.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox