From ef1459bbeb19e1a1c8efbe9d0e689ea83c10d763 Mon Sep 17 00:00:00 2001 From: Brian G Date: Wed, 23 Sep 2026 15:03:24 +0100 Subject: [PATCH] chore: pin GitHub Actions to commit SHAs Pin every `uses:` ref in .github/workflows and composite actions to a full 40-character commit SHA, with the original tag preserved as a comment, e.g. uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 Tags and branches are mutable; commit SHAs are not. Pinning to a SHA closes a supply-chain vector where a compromised action could replace what runs in CI without changing the tag we reference. Generated mechanically with `pinact run` (https://github.com/suzuki-shunsuke/pinact). No version bumps were applied (strict pin). --- .github/workflows/build-lint-test.yml | 10 +++++----- .github/workflows/create-release-pr.yml | 4 ++-- .github/workflows/crowdin.yml | 2 +- .github/workflows/main.yml | 4 ++-- .github/workflows/publish-release.yml | 6 +++--- .github/workflows/publish-site.yml | 8 ++++---- .github/workflows/publish-staging-site.yml | 2 +- .github/workflows/publish-staging.yml | 2 +- .github/workflows/republish-release.yml | 4 ++-- .github/workflows/security-code-scanner.yml | 2 +- 10 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/build-lint-test.yml b/.github/workflows/build-lint-test.yml index deda4c6fea..f4dae0502f 100644 --- a/.github/workflows/build-lint-test.yml +++ b/.github/workflows/build-lint-test.yml @@ -12,7 +12,7 @@ jobs: node-version: [18.x, 20.x, 22.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v1 + uses: MetaMask/action-checkout-and-setup@392abd40aa6a0600a3c0ef4af75851662587e6ec # v1.4.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -28,12 +28,12 @@ jobs: node-version: [22.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v1 + uses: MetaMask/action-checkout-and-setup@392abd40aa6a0600a3c0ef4af75851662587e6ec # v1.4.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} - name: Cache NPM tarballs - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | node_modules/.cache/npm @@ -61,7 +61,7 @@ jobs: node-version: [22.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v1 + uses: MetaMask/action-checkout-and-setup@392abd40aa6a0600a3c0ef4af75851662587e6ec # v1.4.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -90,7 +90,7 @@ jobs: node-version: [18.x, 20.x, 22.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v1 + uses: MetaMask/action-checkout-and-setup@392abd40aa6a0600a3c0ef4af75851662587e6ec # v1.4.0 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} diff --git a/.github/workflows/create-release-pr.yml b/.github/workflows/create-release-pr.yml index 5197d088bf..20e8bb74cb 100644 --- a/.github/workflows/create-release-pr.yml +++ b/.github/workflows/create-release-pr.yml @@ -22,7 +22,7 @@ jobs: pull-requests: write steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v1 + uses: MetaMask/action-checkout-and-setup@392abd40aa6a0600a3c0ef4af75851662587e6ec # v1.4.0 with: is-high-risk-environment: true @@ -34,7 +34,7 @@ jobs: # branch for all git operations and the release PR. ref: ${{ github.event.inputs.base-branch }} - - uses: MetaMask/action-create-release-pr@v4 + - uses: MetaMask/action-create-release-pr@268f95dd4099efbf661dd8ad7a979e7c8cc61ff9 # v4.0.0 with: release-type: ${{ github.event.inputs.release-type }} release-version: ${{ github.event.inputs.release-version }} diff --git a/.github/workflows/crowdin.yml b/.github/workflows/crowdin.yml index e758e67d1c..8a133b9208 100644 --- a/.github/workflows/crowdin.yml +++ b/.github/workflows/crowdin.yml @@ -15,7 +15,7 @@ jobs: name: Synchronize with Crowdin runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Run Crowdin uses: crowdin/github-action@a3160b9e5a9e00739392c23da5e580c6cabe526d with: diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 7ef0fa1767..151c9c9dcc 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v1 + uses: MetaMask/action-checkout-and-setup@392abd40aa6a0600a3c0ef4af75851662587e6ec # v1.4.0 with: is-high-risk-environment: false - name: Download actionlint @@ -86,7 +86,7 @@ jobs: IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }} runs-on: ubuntu-latest steps: - - uses: MetaMask/action-is-release@v2 + - uses: MetaMask/action-is-release@3cd51b98fa98d1347d06f5961299b0172ee31ae8 # v2.3.0 id: is-release publish-release: diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 5ee7e85b08..5a98aec16d 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -29,7 +29,7 @@ jobs: name: Announce release runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - id: name-version name: Get Slack name and version shell: bash @@ -75,11 +75,11 @@ jobs: - announce-release steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v1 + uses: MetaMask/action-checkout-and-setup@392abd40aa6a0600a3c0ef4af75851662587e6ec # v1.4.0 with: is-high-risk-environment: true ref: ${{ github.sha }} - - uses: MetaMask/action-publish-release@v3 + - uses: MetaMask/action-publish-release@f01f1be110d60fb07d86c880ce3d6bdb353524d3 # v3.3.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/publish-site.yml b/.github/workflows/publish-site.yml index bbf7d97e4e..efe50d6a70 100644 --- a/.github/workflows/publish-site.yml +++ b/.github/workflows/publish-site.yml @@ -28,7 +28,7 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v1 + uses: MetaMask/action-checkout-and-setup@392abd40aa6a0600a3c0ef4af75851662587e6ec # v1.4.0 with: is-high-risk-environment: true ref: ${{ inputs.ref || github.sha }} @@ -37,11 +37,11 @@ jobs: env: SEGMENT_PRODUCTION_WRITE_KEY: ${{ secrets.SEGMENT_PRODUCTION_WRITE_KEY }} - name: Setup Pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 with: path: public - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/publish-staging-site.yml b/.github/workflows/publish-staging-site.yml index e2f37a1a5b..899e30b409 100644 --- a/.github/workflows/publish-staging-site.yml +++ b/.github/workflows/publish-staging-site.yml @@ -20,7 +20,7 @@ jobs: if: ${{ inputs.destination_dir == '' }} run: exit 1 - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v1 + uses: MetaMask/action-checkout-and-setup@392abd40aa6a0600a3c0ef4af75851662587e6ec # v1.4.0 with: is-high-risk-environment: true ref: ${{ github.sha }} diff --git a/.github/workflows/publish-staging.yml b/.github/workflows/publish-staging.yml index 03eb40ed75..62823ba74d 100644 --- a/.github/workflows/publish-staging.yml +++ b/.github/workflows/publish-staging.yml @@ -25,7 +25,7 @@ jobs: pull-requests: write steps: - name: Comment on pull request - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/republish-release.yml b/.github/workflows/republish-release.yml index ce60d53672..4c5006d9cd 100644 --- a/.github/workflows/republish-release.yml +++ b/.github/workflows/republish-release.yml @@ -31,7 +31,7 @@ jobs: outputs: tag: ${{ steps.get-release-tag.outputs.tag }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: Get release tag @@ -46,7 +46,7 @@ jobs: needs: - get-release-tag steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ needs.get-release-tag.outputs.tag }} - id: name-version diff --git a/.github/workflows/security-code-scanner.yml b/.github/workflows/security-code-scanner.yml index ababbbeb6f..9cbc3c39fe 100644 --- a/.github/workflows/security-code-scanner.yml +++ b/.github/workflows/security-code-scanner.yml @@ -19,7 +19,7 @@ jobs: security-events: write steps: - name: Analyse code - uses: MetaMask/action-security-code-scanner@v1 + uses: MetaMask/action-security-code-scanner@234d72bd10c689bdf09a58bcc96b367fb00f9ee8 # v1.1.0 with: repo: ${{ github.repository }} paths_ignored: |