Skip to content

docs: document process for updating pinned GitHub Actions SHAs - #2469

Open
singhanurag0317-bit wants to merge 1 commit into
utksh1:mainfrom
singhanurag0317-bit:fix/issue-2401-pin-actions-docs
Open

docs: document process for updating pinned GitHub Actions SHAs#2469
singhanurag0317-bit wants to merge 1 commit into
utksh1:mainfrom
singhanurag0317-bit:fix/issue-2401-pin-actions-docs

Conversation

@singhanurag0317-bit

Copy link
Copy Markdown

Summary

Completes the remaining deliverable from #2401. The action-pinning work itself was already merged in #2402 (all 70 uses: references across the 8 workflows are SHA-pinned with # vX comments, and no @vX tags remain), but the issue also requested:

Document the process for updating pinned SHAs in future maintenance.

This PR adds that documentation.

Changes

  • New docs/github-actions-pinning.md covering:
    • why actions are pinned to immutable SHAs (supply chain risk of mutable tags),
    • the current pinned state and a quick audit command,
    • the step-by-step update process (resolve the tag SHA via git ls-remote, replace the reference, keep the # vX comment, verify),
    • how Dependabot's github-actions ecosystem keeps pins current,
    • ownership and review cadence.

Closes #2401

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Pin GitHub Actions to immutable commit SHAs for improved supply chain security

1 participant