Skip to content

Pin GitHub Actions to commit SHAs - #297

Open
github-security-bot wants to merge 1 commit into
mainfrom
pinner/actions-sha-pins-2026-09-10
Open

Pin GitHub Actions to commit SHAs#297
github-security-bot wants to merge 1 commit into
mainfrom
pinner/actions-sha-pins-2026-09-10

Conversation

@github-security-bot

@github-security-bot github-security-bot commented Sep 10, 2026 •
edited by mrecachinas
Loading

Copy link
Copy Markdown

Pins GitHub Actions uses: references in github/vscode-codeql-starter to immutable commit SHAs.

Summary

Metric Count
Files changed 4
Files scanned 3
Refs found 3
Refs pinned 3
Skipped refs 0
Warnings 0
Errors 0

Why

Pinning actions to full commit SHAs prevents future tag or branch retargeting from changing workflow behavior without review.

Reviewer notes

  • Original refs are preserved in inline comments when possible.
  • Pin comments use the Dependabot-compatible original-ref style.
  • Branch refs were allowed and pinned to their current HEAD; review mutable-branch pins carefully.
  • No minimum action age was enforced for this run.

Pinned refs

Location Before After Resolved as
.github/workflows/check-submodule-pointers.yml:24 actions/checkout@v3 actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 tag
.github/workflows/mirror-main-to-master.yml:18 actions/checkout@v2 actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e tag
.github/workflows/update-codeql-submodule.yml:18 actions/checkout@v3 actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 tag

Dependabot

  • Added .github/dependabot.yml enabling weekly github-actions updates with a 7-day cooldown (cooldown: default-days: 7).
  • The cooldown delays applying a newly published action release for 7 days, reducing exposure to a compromised or broken release while keeping you SHA-pinned.

Generated by pinner 0.1.0.
Copilot AI balanced review requested due to automatic review settings September 10, 2026 21:33
Copilot AI reviewed Sep 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The SHAs match their documented tags, and the Dependabot configuration is valid.

Pull request overview

Pins GitHub Actions to immutable SHAs and enables scheduled Dependabot updates with a seven-day cooldown.

Changes:

  • Pins three actions/checkout references with version comments.
  • Adds weekly Dependabot updates for GitHub Actions.
File summaries
File Description
.github/workflows/update-codeql-submodule.yml Pins checkout v3.7.0.
.github/workflows/mirror-main-to-master.yml Pins checkout v2.8.0.
.github/workflows/check-submodule-pointers.yml Pins checkout v3.7.0.
.github/dependabot.yml Configures weekly action updates with cooldown.
Review details
  • Files reviewed: 4/4 changed files
  • Comments generated: 0
  • Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

2 participants

@github-security-bot