* [PATCH] ci: pin actions in the main workflow to full commit IDs
@ 2026-10-23 16:38 Taylor Blau
2026-10-23 18:05 ` Ben Knoble
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Taylor Blau @ 2026-10-23 16:38 UTC (permalink / raw)
To: git; +Cc: Junio C Hamano, Patrick Steinhardt
Some forks are hosted by organizations that restrict which GitHub
Actions may run, including requiring actions to be pinned to full
commit IDs. Our main CI workflow refers to actions by version tags or
branches, which prevents it from running under such a policy.
Pin those actions to full commit IDs, retaining the version names in
comments to make future updates easier to review.
Signed-off-by: Taylor Blau <ttaylorr@openai.com>
---
This is based on a merge of 'ps/ci-housekeeping-and-modernizations'
and 'jk/http-curl-strip-creds'. The latter is needed for the HTTP
auth tests to pass with the curl versions in current CI.
.github/workflows/main.yml | 64 +++++++++++++++++++-------------------
1 file changed, 32 insertions(+), 32 deletions(-)
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index fe8155772ab..ba0b5ffb634 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -65,7 +65,7 @@ jobs:
echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT
- name: skip if the commit or tree was already tested
id: skip-if-redundant
- uses: actions/github-script@v9
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
if: steps.check-ref.outputs.enabled == 'yes'
with:
github-token: ${{secrets.GITHUB_TOKEN}}
@@ -114,8 +114,8 @@ jobs:
group: windows-build-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
- - uses: git-for-windows/setup-git-for-windows-sdk@v2
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
- name: Install GCC-compatible Rust target
shell: bash
run: |
@@ -149,7 +149,7 @@ jobs:
- name: zip up tracked files
run: git archive -o artifacts/tracked.tar.gz HEAD
- name: upload tracked files and build artifacts
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: windows-artifacts
path: artifacts
@@ -166,14 +166,14 @@ jobs:
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- name: download tracked files and build artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
with:
name: windows-artifacts
path: ${{github.workspace}}
- name: extract tracked files and build artifacts
shell: bash
run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz
- - uses: git-for-windows/setup-git-for-windows-sdk@v2
+ - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
- name: test
shell: bash
run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10
@@ -183,7 +183,7 @@ jobs:
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: failed-tests-windows-${{ matrix.nr }}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -199,20 +199,20 @@ jobs:
group: vs-build-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
- - uses: git-for-windows/setup-git-for-windows-sdk@v2
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
- name: initialize vcpkg
- uses: actions/checkout@v6
+ uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
with:
repository: 'microsoft/vcpkg'
path: 'compat/vcbuild/vcpkg'
- name: download vcpkg artifacts
- uses: git-for-windows/get-azure-pipelines-artifact@v0
+ uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0
with:
repository: git/git
definitionId: 9
- name: add msbuild to PATH
- uses: microsoft/setup-msbuild@v3
+ uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
- name: copy dlls to root
shell: cmd
run: compat\vcbuild\vcpkg_copy_dlls.bat release
@@ -234,7 +234,7 @@ jobs:
- name: zip up tracked files
run: git archive -o artifacts/tracked.tar.gz HEAD
- name: upload tracked files and build artifacts
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: vs-artifacts
path: artifacts
@@ -250,9 +250,9 @@ jobs:
group: vs-test-${{ matrix.nr }}-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: git-for-windows/setup-git-for-windows-sdk@v2
+ - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
- name: download tracked files and build artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
with:
name: vs-artifacts
path: ${{github.workspace}}
@@ -270,7 +270,7 @@ jobs:
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: failed-tests-windows-vs-${{ matrix.nr }}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -284,8 +284,8 @@ jobs:
group: windows-meson-build-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
- - uses: actions/setup-python@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
- name: Set up dependencies
shell: pwsh
run: pip install meson ninja
@@ -296,7 +296,7 @@ jobs:
shell: pwsh
run: meson compile -C build
- name: Upload build artifacts
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: windows-meson-artifacts
path: build
@@ -312,13 +312,13 @@ jobs:
group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
- - uses: actions/setup-python@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
- name: Set up dependencies
shell: pwsh
run: pip install meson ninja
- name: Download build artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
with:
name: windows-meson-artifacts
path: build
@@ -331,7 +331,7 @@ jobs:
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: failed-tests-windows-meson-${{ matrix.nr }}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -367,7 +367,7 @@ jobs:
TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t
runs-on: ${{matrix.vector.pool}}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: ci/run-build-and-tests.sh
- name: print test failures
@@ -375,7 +375,7 @@ jobs:
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: failed-tests-${{matrix.vector.jobname}}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -388,7 +388,7 @@ jobs:
CI_JOB_IMAGE: ubuntu-latest
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: ci/run-build-and-minimal-fuzzers.sh
dockerized:
@@ -464,7 +464,7 @@ jobs:
else
apt-get -q update && apt-get -q -y install git
fi
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: useradd builder --create-home
- run: chown -R builder .
@@ -474,7 +474,7 @@ jobs:
run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: failed-tests-${{matrix.vector.jobname}}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -489,7 +489,7 @@ jobs:
group: static-analysis-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: ci/run-static-analysis.sh
- run: ci/check-directional-formatting.bash
@@ -505,7 +505,7 @@ jobs:
group: rust-analysis-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: ci/run-rust-checks.sh
sparse:
@@ -519,7 +519,7 @@ jobs:
group: sparse-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- name: Install other dependencies
run: ci/install-dependencies.sh
- run: make sparse
@@ -535,6 +535,6 @@ jobs:
CI_JOB_IMAGE: ubuntu-latest
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: ci/test-documentation.sh
base-commit: d46921825429c74931372567941eaf98d4483210
--
2.56.0.187.g9e9ae442333
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] ci: pin actions in the main workflow to full commit IDs
2026-10-23 16:38 [PATCH] ci: pin actions in the main workflow to full commit IDs Taylor Blau
@ 2026-10-23 18:05 ` Ben Knoble
2026-10-23 21:45 ` Junio C Hamano
2026-10-26 18:08 ` [PATCH v2] " Taylor Blau
2 siblings, 0 replies; 7+ messages in thread
From: Ben Knoble @ 2026-10-23 18:05 UTC (permalink / raw)
To: Taylor Blau; +Cc: git, Junio C Hamano, Patrick Steinhardt
> Le 23 oct. 2026 à 12:41, Taylor Blau <ttaylorr@openai.com> a écrit :
>
> Some forks are hosted by organizations that restrict which GitHub
> Actions may run, including requiring actions to be pinned to full
> commit IDs. Our main CI workflow refers to actions by version tags or
> branches, which prevents it from running under such a policy.
Yep. This is becoming de facto security standard.
Perhaps we should say so? « Pinned commit IDs prevent attacks
on CI and any secrets stored therein by compromised action suppliers »
or something?
> Pin those actions to full commit IDs, retaining the version names in
> comments to make future updates easier to review.
>
> Signed-off-by: Taylor Blau <ttaylorr@openai.com>
> ---
> This is based on a merge of 'ps/ci-housekeeping-and-modernizations'
> and 'jk/http-curl-strip-creds'. The latter is needed for the HTTP
> auth tests to pass with the curl versions in current CI.
>
> .github/workflows/main.yml | 64 +++++++++++++++++++-------------------
> 1 file changed, 32 insertions(+), 32 deletions(-)
>
> diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
> index fe8155772ab..ba0b5ffb634 100644
> --- a/.github/workflows/main.yml
> +++ b/.github/workflows/main.yml
> @@ -65,7 +65,7 @@ jobs:
> echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT
> - name: skip if the commit or tree was already tested
> id: skip-if-redundant
> - uses: actions/github-script@v9
> + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
> if: steps.check-ref.outputs.enabled == 'yes'
> with:
> github-token: ${{secrets.GITHUB_TOKEN}}
> @@ -114,8 +114,8 @@ jobs:
> group: windows-build-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> - - uses: git-for-windows/setup-git-for-windows-sdk@v2
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
> - name: Install GCC-compatible Rust target
> shell: bash
> run: |
> @@ -149,7 +149,7 @@ jobs:
> - name: zip up tracked files
> run: git archive -o artifacts/tracked.tar.gz HEAD
> - name: upload tracked files and build artifacts
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: windows-artifacts
> path: artifacts
> @@ -166,14 +166,14 @@ jobs:
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - name: download tracked files and build artifacts
> - uses: actions/download-artifact@v8
> + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
> with:
> name: windows-artifacts
> path: ${{github.workspace}}
> - name: extract tracked files and build artifacts
> shell: bash
> run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz
> - - uses: git-for-windows/setup-git-for-windows-sdk@v2
> + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
> - name: test
> shell: bash
> run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10
> @@ -183,7 +183,7 @@ jobs:
> run: ci/print-test-failures.sh
> - name: Upload failed tests' directories
> if: failure() && env.FAILED_TEST_ARTIFACTS != ''
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: failed-tests-windows-${{ matrix.nr }}
> path: ${{env.FAILED_TEST_ARTIFACTS}}
> @@ -199,20 +199,20 @@ jobs:
> group: vs-build-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> - - uses: git-for-windows/setup-git-for-windows-sdk@v2
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
> - name: initialize vcpkg
> - uses: actions/checkout@v6
> + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> with:
> repository: 'microsoft/vcpkg'
> path: 'compat/vcbuild/vcpkg'
> - name: download vcpkg artifacts
> - uses: git-for-windows/get-azure-pipelines-artifact@v0
> + uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0
> with:
> repository: git/git
> definitionId: 9
> - name: add msbuild to PATH
> - uses: microsoft/setup-msbuild@v3
> + uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
> - name: copy dlls to root
> shell: cmd
> run: compat\vcbuild\vcpkg_copy_dlls.bat release
> @@ -234,7 +234,7 @@ jobs:
> - name: zip up tracked files
> run: git archive -o artifacts/tracked.tar.gz HEAD
> - name: upload tracked files and build artifacts
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: vs-artifacts
> path: artifacts
> @@ -250,9 +250,9 @@ jobs:
> group: vs-test-${{ matrix.nr }}-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: git-for-windows/setup-git-for-windows-sdk@v2
> + - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
> - name: download tracked files and build artifacts
> - uses: actions/download-artifact@v8
> + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
> with:
> name: vs-artifacts
> path: ${{github.workspace}}
> @@ -270,7 +270,7 @@ jobs:
> run: ci/print-test-failures.sh
> - name: Upload failed tests' directories
> if: failure() && env.FAILED_TEST_ARTIFACTS != ''
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: failed-tests-windows-vs-${{ matrix.nr }}
> path: ${{env.FAILED_TEST_ARTIFACTS}}
> @@ -284,8 +284,8 @@ jobs:
> group: windows-meson-build-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> - - uses: actions/setup-python@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
> - name: Set up dependencies
> shell: pwsh
> run: pip install meson ninja
> @@ -296,7 +296,7 @@ jobs:
> shell: pwsh
> run: meson compile -C build
> - name: Upload build artifacts
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: windows-meson-artifacts
> path: build
> @@ -312,13 +312,13 @@ jobs:
> group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> - - uses: actions/setup-python@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
> - name: Set up dependencies
> shell: pwsh
> run: pip install meson ninja
> - name: Download build artifacts
> - uses: actions/download-artifact@v8
> + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
> with:
> name: windows-meson-artifacts
> path: build
> @@ -331,7 +331,7 @@ jobs:
> run: ci/print-test-failures.sh
> - name: Upload failed tests' directories
> if: failure() && env.FAILED_TEST_ARTIFACTS != ''
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: failed-tests-windows-meson-${{ matrix.nr }}
> path: ${{env.FAILED_TEST_ARTIFACTS}}
> @@ -367,7 +367,7 @@ jobs:
> TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t
> runs-on: ${{matrix.vector.pool}}
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: ci/run-build-and-tests.sh
> - name: print test failures
> @@ -375,7 +375,7 @@ jobs:
> run: ci/print-test-failures.sh
> - name: Upload failed tests' directories
> if: failure() && env.FAILED_TEST_ARTIFACTS != ''
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: failed-tests-${{matrix.vector.jobname}}
> path: ${{env.FAILED_TEST_ARTIFACTS}}
> @@ -388,7 +388,7 @@ jobs:
> CI_JOB_IMAGE: ubuntu-latest
> runs-on: ubuntu-latest
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: ci/run-build-and-minimal-fuzzers.sh
> dockerized:
> @@ -464,7 +464,7 @@ jobs:
> else
> apt-get -q update && apt-get -q -y install git
> fi
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: useradd builder --create-home
> - run: chown -R builder .
> @@ -474,7 +474,7 @@ jobs:
> run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh
> - name: Upload failed tests' directories
> if: failure() && env.FAILED_TEST_ARTIFACTS != ''
> - uses: actions/upload-artifact@v7
> + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
> with:
> name: failed-tests-${{matrix.vector.jobname}}
> path: ${{env.FAILED_TEST_ARTIFACTS}}
> @@ -489,7 +489,7 @@ jobs:
> group: static-analysis-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: ci/run-static-analysis.sh
> - run: ci/check-directional-formatting.bash
> @@ -505,7 +505,7 @@ jobs:
> group: rust-analysis-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: ci/run-rust-checks.sh
> sparse:
> @@ -519,7 +519,7 @@ jobs:
> group: sparse-${{ github.ref }}
> cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - name: Install other dependencies
> run: ci/install-dependencies.sh
> - run: make sparse
> @@ -535,6 +535,6 @@ jobs:
> CI_JOB_IMAGE: ubuntu-latest
> runs-on: ubuntu-latest
> steps:
> - - uses: actions/checkout@v6
> + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
> - run: ci/install-dependencies.sh
> - run: ci/test-documentation.sh
>
> base-commit: d46921825429c74931372567941eaf98d4483210
> --
> 2.56.0.187.g9e9ae442333
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] ci: pin actions in the main workflow to full commit IDs
2026-10-23 16:38 [PATCH] ci: pin actions in the main workflow to full commit IDs Taylor Blau
2026-10-23 18:05 ` Ben Knoble
@ 2026-10-23 21:45 ` Junio C Hamano
2026-10-24 0:32 ` Taylor Blau
2026-10-26 18:08 ` [PATCH v2] " Taylor Blau
2 siblings, 1 reply; 7+ messages in thread
From: Junio C Hamano @ 2026-10-23 21:45 UTC (permalink / raw)
To: Taylor Blau; +Cc: git, Patrick Steinhardt
Taylor Blau <ttaylorr@openai.com> writes:
> Some forks are hosted by organizations that restrict which GitHub
> Actions may run, including requiring actions to be pinned to full
> commit IDs. Our main CI workflow refers to actions by version tags or
> branches, which prevents it from running under such a policy.
I do not see why the limitations of other organizations should
affect our workflow here. What if another organization prefers
readable and concise tag names? Would they send a patch to revert
this change, leading to a "last one wins" situation?
Would it be too much trouble for organizations with this specific
requirement to maintain such changes in their own forks? When we
need to update a dependency (for example, when 'checkout@v6' is
deprecated and we transition to 'checkout@v7'), it would result in a
conflict anyway. At that point, someone has to translate the
symbolic name to a full object name. It seems only fair that the
organizations requiring this level of pinning handle that
translation themselves, and the conflict will tell them exactly
which line has the symbolic name that needs to be translated to a
full object name.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] ci: pin actions in the main workflow to full commit IDs
2026-10-23 21:45 ` Junio C Hamano
@ 2026-10-24 0:32 ` Taylor Blau
2026-10-24 1:38 ` Junio C Hamano
0 siblings, 1 reply; 7+ messages in thread
From: Taylor Blau @ 2026-10-24 0:32 UTC (permalink / raw)
To: Junio C Hamano; +Cc: git, Patrick Steinhardt
On Fri, Oct 23, 2026 at 02:45:01PM -0700, Junio C Hamano wrote:
> Taylor Blau <ttaylorr@openai.com> writes:
>
> > Some forks are hosted by organizations that restrict which GitHub
> > Actions may run, including requiring actions to be pinned to full
> > commit IDs. Our main CI workflow refers to actions by version tags or
> > branches, which prevents it from running under such a policy.
>
> I do not see why the limitations of other organizations should
> affect our workflow here. What if another organization prefers
> readable and concise tag names? Would they send a patch to revert
> this change, leading to a "last one wins" situation?
I see what you're saying, but I think in this particular case there *is*
a good reason to do this in your tree.
These actions are executable dependencies of our CI, so if a malicious
actor points, say, checkout@v6 at something which modifies code in the
tree, we are relying entirely on the permissions of CI's configured
$GITHUB_TOKEN to save us from code injection.
There is maintenance involved, including deliberately picking up bug
and security fixes within a major version. But using a tag does not
eliminate the decision about which code to execute; it delegates that
decision to whoever can update the tag. I think making those updates
explicit in our repository is worth the maintenance.
Keeping a downstream patch is certainly possible. But having each fork
repeat the same translation leaves the upstream workflow without that
protection and duplicates the work. That is why I think this belongs
upstream.
I think that we could reword the commit message to explain that benefit
more clearly, but I do think this is the right policy.
> Would it be too much trouble for organizations with this specific
> requirement to maintain such changes in their own forks?
Just as a concrete example, before submitting patches out of openai/git,
I apply this patch on top of my branch, then run CI, and then remove the
extraneous commit before sending. This happens on every topic, and
AFAICT this is not an uncommon restriction among other corporate
organization accounts on GitHub.
Thanks,
Taylor
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] ci: pin actions in the main workflow to full commit IDs
2026-10-24 0:32 ` Taylor Blau
@ 2026-10-24 1:38 ` Junio C Hamano
0 siblings, 0 replies; 7+ messages in thread
From: Junio C Hamano @ 2026-10-24 1:38 UTC (permalink / raw)
To: Taylor Blau; +Cc: git, Patrick Steinhardt
Taylor Blau <ttaylorr@openai.com> writes:
> I think that we could reword the commit message to explain that benefit
> more clearly, but I do think this is the right policy.
Together with Ben Knoble's comments, I very much appreciate your
pushing back. I agree that a different justification would be a
good way to go.
Thanks.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v2] ci: pin actions in the main workflow to full commit IDs
2026-10-23 16:38 [PATCH] ci: pin actions in the main workflow to full commit IDs Taylor Blau
2026-10-23 18:05 ` Ben Knoble
2026-10-23 21:45 ` Junio C Hamano
@ 2026-10-26 18:08 ` Taylor Blau
2026-10-26 18:20 ` Junio C Hamano
2 siblings, 1 reply; 7+ messages in thread
From: Taylor Blau @ 2026-10-26 18:08 UTC (permalink / raw)
To: git; +Cc: Junio C Hamano, Patrick Steinhardt
Our main CI workflow refers to actions by version tags. These tags can
move, changing the action code we run without any change to our
repository. If an attacker gains access to an action's repository,
they can move an existing tag to a malicious revision and have our
workflow pick it up automatically.
Pin these actions to full commit IDs so that moving a tag cannot
substitute a different action revision. Updating the actions will
require an explicit change to our workflow, including when picking up
bug fixes and security fixes within a major version.
Retain the version names in comments to keep the references readable
and make future updates easier to review.
Signed-off-by: Taylor Blau <ttaylorr@openai.com>
---
.github/workflows/main.yml | 64 +++++++++++++++++++-------------------
1 file changed, 32 insertions(+), 32 deletions(-)
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index fe8155772ab..ba0b5ffb634 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -65,7 +65,7 @@ jobs:
echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT
- name: skip if the commit or tree was already tested
id: skip-if-redundant
- uses: actions/github-script@v9
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
if: steps.check-ref.outputs.enabled == 'yes'
with:
github-token: ${{secrets.GITHUB_TOKEN}}
@@ -114,8 +114,8 @@ jobs:
group: windows-build-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
- - uses: git-for-windows/setup-git-for-windows-sdk@v2
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
- name: Install GCC-compatible Rust target
shell: bash
run: |
@@ -149,7 +149,7 @@ jobs:
- name: zip up tracked files
run: git archive -o artifacts/tracked.tar.gz HEAD
- name: upload tracked files and build artifacts
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: windows-artifacts
path: artifacts
@@ -166,14 +166,14 @@ jobs:
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- name: download tracked files and build artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
with:
name: windows-artifacts
path: ${{github.workspace}}
- name: extract tracked files and build artifacts
shell: bash
run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz
- - uses: git-for-windows/setup-git-for-windows-sdk@v2
+ - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
- name: test
shell: bash
run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10
@@ -183,7 +183,7 @@ jobs:
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: failed-tests-windows-${{ matrix.nr }}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -199,20 +199,20 @@ jobs:
group: vs-build-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
- - uses: git-for-windows/setup-git-for-windows-sdk@v2
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
- name: initialize vcpkg
- uses: actions/checkout@v6
+ uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
with:
repository: 'microsoft/vcpkg'
path: 'compat/vcbuild/vcpkg'
- name: download vcpkg artifacts
- uses: git-for-windows/get-azure-pipelines-artifact@v0
+ uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0
with:
repository: git/git
definitionId: 9
- name: add msbuild to PATH
- uses: microsoft/setup-msbuild@v3
+ uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
- name: copy dlls to root
shell: cmd
run: compat\vcbuild\vcpkg_copy_dlls.bat release
@@ -234,7 +234,7 @@ jobs:
- name: zip up tracked files
run: git archive -o artifacts/tracked.tar.gz HEAD
- name: upload tracked files and build artifacts
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: vs-artifacts
path: artifacts
@@ -250,9 +250,9 @@ jobs:
group: vs-test-${{ matrix.nr }}-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: git-for-windows/setup-git-for-windows-sdk@v2
+ - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2
- name: download tracked files and build artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
with:
name: vs-artifacts
path: ${{github.workspace}}
@@ -270,7 +270,7 @@ jobs:
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: failed-tests-windows-vs-${{ matrix.nr }}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -284,8 +284,8 @@ jobs:
group: windows-meson-build-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
- - uses: actions/setup-python@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
- name: Set up dependencies
shell: pwsh
run: pip install meson ninja
@@ -296,7 +296,7 @@ jobs:
shell: pwsh
run: meson compile -C build
- name: Upload build artifacts
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: windows-meson-artifacts
path: build
@@ -312,13 +312,13 @@ jobs:
group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
- - uses: actions/setup-python@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+ - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
- name: Set up dependencies
shell: pwsh
run: pip install meson ninja
- name: Download build artifacts
- uses: actions/download-artifact@v8
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
with:
name: windows-meson-artifacts
path: build
@@ -331,7 +331,7 @@ jobs:
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: failed-tests-windows-meson-${{ matrix.nr }}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -367,7 +367,7 @@ jobs:
TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t
runs-on: ${{matrix.vector.pool}}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: ci/run-build-and-tests.sh
- name: print test failures
@@ -375,7 +375,7 @@ jobs:
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: failed-tests-${{matrix.vector.jobname}}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -388,7 +388,7 @@ jobs:
CI_JOB_IMAGE: ubuntu-latest
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: ci/run-build-and-minimal-fuzzers.sh
dockerized:
@@ -464,7 +464,7 @@ jobs:
else
apt-get -q update && apt-get -q -y install git
fi
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: useradd builder --create-home
- run: chown -R builder .
@@ -474,7 +474,7 @@ jobs:
run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: failed-tests-${{matrix.vector.jobname}}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -489,7 +489,7 @@ jobs:
group: static-analysis-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: ci/run-static-analysis.sh
- run: ci/check-directional-formatting.bash
@@ -505,7 +505,7 @@ jobs:
group: rust-analysis-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: ci/run-rust-checks.sh
sparse:
@@ -519,7 +519,7 @@ jobs:
group: sparse-${{ github.ref }}
cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- name: Install other dependencies
run: ci/install-dependencies.sh
- run: make sparse
@@ -535,6 +535,6 @@ jobs:
CI_JOB_IMAGE: ubuntu-latest
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v6
+ - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
- run: ci/install-dependencies.sh
- run: ci/test-documentation.sh
Range-diff against v1:
1: a178dde02a8 ! 1: 67057c2277e ci: pin actions in the main workflow to full commit IDs
@@ Metadata
## Commit message ##
ci: pin actions in the main workflow to full commit IDs
- Some forks are hosted by organizations that restrict which GitHub
- Actions may run, including requiring actions to be pinned to full
- commit IDs. Our main CI workflow refers to actions by version tags or
- branches, which prevents it from running under such a policy.
+ Our main CI workflow refers to actions by version tags. These tags can
+ move, changing the action code we run without any change to our
+ repository. If an attacker gains access to an action's repository,
+ they can move an existing tag to a malicious revision and have our
+ workflow pick it up automatically.
- Pin those actions to full commit IDs, retaining the version names in
- comments to make future updates easier to review.
+ Pin these actions to full commit IDs so that moving a tag cannot
+ substitute a different action revision. Updating the actions will
+ require an explicit change to our workflow, including when picking up
+ bug fixes and security fixes within a major version.
+
+ Retain the version names in comments to keep the references readable
+ and make future updates easier to review.
Signed-off-by: Taylor Blau <ttaylorr@openai.com>
base-commit: d46921825429c74931372567941eaf98d4483210
--
2.56.0.187.g9e9ae442333
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v2] ci: pin actions in the main workflow to full commit IDs
2026-10-26 18:08 ` [PATCH v2] " Taylor Blau
@ 2026-10-26 18:20 ` Junio C Hamano
0 siblings, 0 replies; 7+ messages in thread
From: Junio C Hamano @ 2026-10-26 18:20 UTC (permalink / raw)
To: Taylor Blau; +Cc: git, Patrick Steinhardt
Taylor Blau <ttaylorr@openai.com> writes:
> Our main CI workflow refers to actions by version tags. These tags can
> move, changing the action code we run without any change to our
> repository. If an attacker gains access to an action's repository,
> they can move an existing tag to a malicious revision and have our
> workflow pick it up automatically.
>
> Pin these actions to full commit IDs so that moving a tag cannot
> substitute a different action revision. Updating the actions will
> require an explicit change to our workflow, including when picking up
> bug fixes and security fixes within a major version.
>
> Retain the version names in comments to keep the references readable
> and make future updates easier to review.
>
> Signed-off-by: Taylor Blau <ttaylorr@openai.com>
> ---
> .github/workflows/main.yml | 64 +++++++++++++++++++-------------------
> 1 file changed, 32 insertions(+), 32 deletions(-)
With these changes, the proposal no longer appears to bend the
public version to suit a single employee's environment. We might
even want to strengthen the reasoning by adding "becoming the
de facto security standard", borrowing from Ben Knoble's comment in
the previous round.
Thanks. Queued.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-10-26 18:20 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-23 16:38 [PATCH] ci: pin actions in the main workflow to full commit IDs Taylor Blau
2026-10-23 18:05 ` Ben Knoble
2026-10-23 21:45 ` Junio C Hamano
2026-10-24 0:32 ` Taylor Blau
2026-10-24 1:38 ` Junio C Hamano
2026-10-26 18:08 ` [PATCH v2] " Taylor Blau
2026-10-26 18:20 ` Junio C Hamano
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox