From 7a0c9731cb73cc41d11c459063acdb85e3bed9d4 Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Wed, 29 Jul 2026 09:26:38 -0700 Subject: [PATCH] ci: pin every bare actions/*@vN reference to a full commit SHA (BE-5121) Seven workflow files still referenced first-party actions by mutable major tag, contrary to the repo rule in AGENTS.md ("Pin everything by full commit SHA, with a trailing '# vN' comment"). A moved tag silently changes what runs in CI here and, via the reusable workflows, for every consumer. Every SHA reuses the pin already present elsewhere in this repo for the same major version, and each was independently confirmed against the live tag with 'gh api repos/actions//commits/'. Same major versions as before, so no behaviour change is expected. --- .github/workflows/agents-md-integrity.yml | 6 +++--- .github/workflows/assign-prs-to-author.yml | 2 +- .../workflows/cursor-review-auto-label.yml | 2 +- .github/workflows/cursor-review.yml | 20 +++++++++---------- .../workflows/test-agents-md-integrity.yml | 4 ++-- .github/workflows/test-bump-callers.yml | 2 +- .../workflows/test-cursor-review-scripts.yml | 4 ++-- 7 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/agents-md-integrity.yml b/.github/workflows/agents-md-integrity.yml index 1890bffa..32bdcf0d 100644 --- a/.github/workflows/agents-md-integrity.yml +++ b/.github/workflows/agents-md-integrity.yml @@ -120,14 +120,14 @@ jobs: contents: read steps: - name: Checkout caller repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false - name: Load integrity check script # The checker comes from THIS repo (public, pinned via workflows_ref), # never from the caller's checkout, so a PR can't rewrite the check. - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: Comfy-Org/github-workflows ref: ${{ inputs.workflows_ref }} @@ -135,7 +135,7 @@ jobs: persist-credentials: false - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.12' diff --git a/.github/workflows/assign-prs-to-author.yml b/.github/workflows/assign-prs-to-author.yml index 783e9034..4fe31492 100644 --- a/.github/workflows/assign-prs-to-author.yml +++ b/.github/workflows/assign-prs-to-author.yml @@ -45,7 +45,7 @@ jobs: issues: write steps: - name: Assign unassigned PRs to their authors - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const skipBots = ${{ inputs.skip-bots }}; diff --git a/.github/workflows/cursor-review-auto-label.yml b/.github/workflows/cursor-review-auto-label.yml index 65d87ab4..0dcd01eb 100644 --- a/.github/workflows/cursor-review-auto-label.yml +++ b/.github/workflows/cursor-review-auto-label.yml @@ -89,7 +89,7 @@ jobs: steps: - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }} diff --git a/.github/workflows/cursor-review.yml b/.github/workflows/cursor-review.yml index cac1da2c..da4ae261 100644 --- a/.github/workflows/cursor-review.yml +++ b/.github/workflows/cursor-review.yml @@ -260,7 +260,7 @@ jobs: within_cap: ${{ steps.count.outputs.within_cap }} steps: - name: Checkout PR repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 persist-credentials: false @@ -456,7 +456,7 @@ jobs: PY - name: Checkout PR repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 persist-credentials: false @@ -466,7 +466,7 @@ jobs: # pinned via workflows_ref) — never from the PR checkout, so a # malicious PR can't rewrite the prompt to exfiltrate the diff or # smuggle instructions to the model. - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: Comfy-Org/github-workflows ref: ${{ inputs.workflows_ref }} @@ -567,7 +567,7 @@ jobs: - name: Upload findings artifact if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: findings-${{ matrix.review_type }}-${{ matrix.model }} path: /tmp/findings-out/findings.json @@ -587,13 +587,13 @@ jobs: pull-requests: write steps: - name: Checkout PR repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 persist-credentials: false - name: Load cursor-review assets - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: Comfy-Org/github-workflows ref: ${{ inputs.workflows_ref }} @@ -615,7 +615,7 @@ jobs: echo "$HOME/.cursor/bin" >> "$GITHUB_PATH" - name: Download panel findings - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: path: /tmp/panel pattern: findings-* @@ -820,7 +820,7 @@ jobs: - name: Mint bot-identity token (optional) id: bot_token if: ${{ inputs.bot_app_id != '' }} - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: app-id: ${{ inputs.bot_app_id }} private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }} @@ -877,7 +877,7 @@ jobs: contents: read steps: - name: Load cursor-review assets - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: Comfy-Org/github-workflows ref: ${{ inputs.workflows_ref }} @@ -931,7 +931,7 @@ jobs: contents: read steps: - name: Load cursor-review assets - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: Comfy-Org/github-workflows ref: ${{ inputs.workflows_ref }} diff --git a/.github/workflows/test-agents-md-integrity.yml b/.github/workflows/test-agents-md-integrity.yml index d9527a0a..3db66648 100644 --- a/.github/workflows/test-agents-md-integrity.yml +++ b/.github/workflows/test-agents-md-integrity.yml @@ -27,12 +27,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.12' diff --git a/.github/workflows/test-bump-callers.yml b/.github/workflows/test-bump-callers.yml index beb70865..d07b6285 100644 --- a/.github/workflows/test-bump-callers.yml +++ b/.github/workflows/test-bump-callers.yml @@ -41,7 +41,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false diff --git a/.github/workflows/test-cursor-review-scripts.yml b/.github/workflows/test-cursor-review-scripts.yml index fde5e6eb..cac03409 100644 --- a/.github/workflows/test-cursor-review-scripts.yml +++ b/.github/workflows/test-cursor-review-scripts.yml @@ -25,12 +25,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.12'