From 4a15100acae8d76908f1a32866acadcbe9dde53f Mon Sep 17 00:00:00 2001 From: Karl Waldman Date: Wed, 14 Oct 2026 14:52:16 -0400 Subject: [PATCH] ci: pin download-artifact v8.0.2 and assert SHA pinning by shape tests/release-readiness.test.ts hard-coded the exact download-artifact SHA, so Dependabot's bump (#133) could never pass. Assert that both artifact actions are pinned to a 40-hex commit SHA and never to a tag instead, and take the v8.0.2 pin (9000827c, verified against the tag). Supersedes #133. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01QQ7W3CkRKEnBpU5KRQUfUu --- .github/workflows/publish.yml | 4 ++-- tests/release-readiness.test.ts | 7 +++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 7a00ff8..c816cc0 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -121,7 +121,7 @@ jobs: id-token: write steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: verified-npm-package path: ${{ runner.temp }}/release-artifact @@ -202,7 +202,7 @@ jobs: contents: write steps: - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: verified-npm-package path: ${{ runner.temp }}/release-artifact diff --git a/tests/release-readiness.test.ts b/tests/release-readiness.test.ts index 1f33c13..3632bfa 100644 --- a/tests/release-readiness.test.ts +++ b/tests/release-readiness.test.ts @@ -39,8 +39,11 @@ describe("release readiness", () => { const actions = workflow.match(/uses:\s+actions\/[^@\s]+@([^\s#]+)/g) ?? []; expect(workflow).toContain("Verify release tag matches package version and protected main"); - expect(workflow).toContain("actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"); - expect(workflow).toContain("actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"); + // Pin by full commit SHA, but do not hard-code which SHA: Dependabot + // bumps the pin and a literal here turned every such PR red. + expect(workflow).toMatch(/actions\/upload-artifact@[0-9a-f]{40}\s/); + expect(workflow).toMatch(/actions\/download-artifact@[0-9a-f]{40}\s/); + expect(workflow).not.toMatch(/actions\/(?:upload|download)-artifact@v\d/); expect(workflow).toContain('cp scripts/resolve-npm-publication.mjs "$ARTIFACT_DIR/"'); expect(publishJob).toContain("id-token: write"); expect(publishJob).toContain("sha256sum -c artifact.sha256");