Pinning GitHub actions #24
Conversation
There was a problem hiding this comment.
Pull request overview
This PR enhances security by pinning GitHub Actions to specific commit hashes rather than mutable version tags. This prevents potential supply chain attacks where action versions could be modified maliciously.
Key changes:
- Pinned
actions/checkoutandactions/setup-nodeto specific commit SHAs - Added version comments for traceability
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/release.yml | Pinned checkout action to v2.7.0 and setup-node to v1.4.6 with commit hashes |
| .github/workflows/build.yml | Pinned checkout action to v3.6.0 and setup-node to v3.9.1 with commit hashes |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v2 | ||
| uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 |
There was a problem hiding this comment.
The actions/checkout@v2 action is outdated. This workflow uses v2.7.0 while the build workflow uses v3.6.0. Consider upgrading to v4 (the latest major version) for consistency and to benefit from security updates and improvements. The current v2 version is no longer actively maintained.
| uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 | |
| uses: actions/checkout@v4 |
| uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v1 | ||
| uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6 |
There was a problem hiding this comment.
The actions/setup-node@v1 action is outdated. This workflow uses v1.4.6 while the build workflow uses v3.9.1. Consider upgrading to v4 (the latest major version) or at least v3 for consistency with the build workflow and to benefit from security updates and improvements. The v1 version is no longer actively maintained.
| uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6 | |
| uses: actions/setup-node@v4 |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Summary by cubic
Pinned GitHub Actions to specific commit SHAs in build and release workflows to meet ENG-11298 and improve security and reproducibility.
Written for commit df1ec31. Summary will update automatically on new commits.