Skip to content

chore: pin GitHub Actions to full-length commit SHAs #855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joshuarli wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: pin GitHub Actions to full-length commit SHAs #855

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,10 @@ jobs:
if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "20"

Expand All @@ -38,7 +38,7 @@ jobs:
run: |
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

- uses: actions/cache@v4
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
name: Setup pnpm cache
with:
path: ${{ env.STORE_PATH }}
Expand All @@ -57,7 +57,7 @@ jobs:

- name: Deploy to Canary Worker
id: deploy_canary
uses: cloudflare/wrangler-action@v3
uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3
with:
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
Expand Down Expand Up @@ -94,7 +94,7 @@ jobs:
- name: Deploy to Production Worker
id: deploy_production
if: steps.canary_smoke_tests.outcome == 'success'
uses: cloudflare/wrangler-action@v3
uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3
with:
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
Expand Down Expand Up @@ -130,7 +130,7 @@ jobs:
# === ROLLBACK IF PRODUCTION SMOKE TESTS FAIL ===
- name: Rollback Production on Smoke Test Failure
if: steps.production_smoke_tests.outcome == 'failure'
uses: cloudflare/wrangler-action@v3
uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3
with:
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/eval.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,10 @@ jobs:
checks: write
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "20"

Expand All @@ -42,7 +42,7 @@ jobs:
run: |
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

- uses: actions/cache@v4
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
name: Setup pnpm cache
with:
path: ${{ env.STORE_PATH }}
Expand All @@ -63,7 +63,7 @@ jobs:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

- name: Create eval status check
uses: actions/github-script@v7
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
# Skip for fork PRs (no write permissions) but still run for pushes, workflow_dispatch, and same-repo PRs
if: ${{ !cancelled() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
continue-on-error: true # Don't fail workflow if check creation fails
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/merge-jobs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,13 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

- name: Setup pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@02f6c237bd2518259fed6c71566509edfb3f2b74 # v4
Copy link
Copy Markdown

@cursor cursor bot Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inconsistent pnpm/action-setup SHA across workflow files

Low Severity

pnpm/action-setup in merge-jobs.yml is pinned to SHA 02f6c237bd2518259fed6c71566509edfb3f2b74, while all six other workflow files (deploy.yml, eval.yml, release.yml, smoke-tests.yml, test.yml, token-cost.yml) use SHA a7487c7e89a18df4991f7f222e4898a00d66ddda. Both are labeled as v4 but point to different commits, meaning merge-jobs.yml runs a different version of the action than every other workflow.

Additional Locations (1)
Fix in Cursor Fix in Web


- name: Set up Node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version-file: 'package.json'
cache: 'pnpm'
Expand All @@ -39,7 +39,7 @@ jobs:
run: pnpm pack --pack-destination dist

- name: Archive artifacts
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: ${{ github.sha }}
path: |
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,13 +31,13 @@ jobs:
private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}

- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
with:
token: ${{ steps.token.outputs.token }}
fetch-depth: 0

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "20"

Expand All @@ -56,7 +56,7 @@ jobs:
echo "version=$NEW" >> "$GITHUB_OUTPUT"

- name: Prepare release
uses: getsentry/action-prepare-release@v1
uses: getsentry/action-prepare-release@c8e1c2009ab08259029170132c384f03c1064c0e # v1
env:
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
with:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/smoke-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "20"

Expand All @@ -33,7 +33,7 @@ jobs:
run: |
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

- uses: actions/cache@v4
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
name: Setup pnpm cache
with:
path: ${{ env.STORE_PATH }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,10 @@ jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "20"

Expand All @@ -27,7 +27,7 @@ jobs:
run: |
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

- uses: actions/cache@v4
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
name: Setup pnpm cache
with:
path: ${{ env.STORE_PATH }}
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/token-cost.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ jobs:
measure-tokens:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

- name: Setup Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: "20"

Expand All @@ -32,7 +32,7 @@ jobs:
run: |
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

- uses: actions/cache@v4
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
name: Setup pnpm cache
with:
path: ${{ env.STORE_PATH }}
Expand Down Expand Up @@ -100,7 +100,7 @@ jobs:

- name: Download main branch token stats
if: github.event_name == 'pull_request'
uses: dawidd6/action-download-artifact@v6
uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
continue-on-error: true
with:
workflow: token-cost.yml
Expand Down Expand Up @@ -162,7 +162,7 @@ jobs:
cat token-report.md >> $GITHUB_STEP_SUMMARY

- name: Create check run
uses: actions/github-script@v7
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
# Skip for fork PRs (no write permissions) but still run for pushes and same-repo PRs
if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
continue-on-error: true # Don't fail workflow if check creation fails
Expand Down Expand Up @@ -219,7 +219,7 @@ jobs:
});

- name: Comment on PR if token count changed
uses: actions/github-script@v7
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
# Skip for fork PRs (no write permissions)
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && steps.compare.outputs.has_comparison == 'true' && steps.compare.outputs.delta != '0'
continue-on-error: true # Don't fail workflow if comment creation fails
Expand Down Expand Up @@ -258,7 +258,7 @@ jobs:
}

- name: Upload token stats artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
if: always()
with:
name: token-stats-${{ github.sha }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/warden.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,14 +15,14 @@ jobs:
WARDEN_MODEL: ${{ secrets.WARDEN_MODEL }}
WARDEN_SENTRY_DSN: ${{ secrets.WARDEN_SENTRY_DSN }}
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

- uses: actions/create-github-app-token@v1
- uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
id: app-token
with:
app-id: ${{ secrets.WARDEN_APP_ID }}
private-key: ${{ secrets.WARDEN_PRIVATE_KEY }}

- uses: getsentry/warden@v0
- uses: getsentry/warden@34257abaeda3b030eb45a0971060d509ce0fea51 # v0
with:
github-token: ${{ steps.app-token.outputs.token }}
Loading