From e81dd72db49d4762e104e4346ac3a546d68d9084 Mon Sep 17 00:00:00 2001 From: Brian G Date: Fri, 18 Sep 2026 09:48:07 +0100 Subject: [PATCH] chore: pin GitHub Actions to commit SHAs Pin every `uses:` ref in .github/workflows and composite actions to a full 40-character commit SHA, with the original tag preserved as a comment, e.g. uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 Tags and branches are mutable; commit SHAs are not. Pinning to a SHA closes a supply-chain vector where a compromised action could replace what runs in CI without changing the tag we reference. Generated mechanically with `pinact run` (https://github.com/suzuki-shunsuke/pinact). No version bumps were applied (strict pin). --- .github/workflows/build-lint-test.yml | 10 +++++----- .github/workflows/create-release-pr.yml | 4 ++-- .github/workflows/main.yml | 6 +++--- .github/workflows/publish-release.yml | 18 +++++++++--------- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/build-lint-test.yml b/.github/workflows/build-lint-test.yml index 704a1e5..cfa9e08 100644 --- a/.github/workflows/build-lint-test.yml +++ b/.github/workflows/build-lint-test.yml @@ -12,7 +12,7 @@ jobs: node-version: [20.x, 22.x, 24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@29e23b68b9b868d31805d1adce431cb35fd2de83 # v2.0.1 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -27,7 +27,7 @@ jobs: node-version: [24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@29e23b68b9b868d31805d1adce431cb35fd2de83 # v2.0.1 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -49,7 +49,7 @@ jobs: node-version: [24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@29e23b68b9b868d31805d1adce431cb35fd2de83 # v2.0.1 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -77,7 +77,7 @@ jobs: node-version: [20.x, 22.x, 24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@29e23b68b9b868d31805d1adce431cb35fd2de83 # v2.0.1 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} @@ -99,7 +99,7 @@ jobs: node-version: [20.x, 22.x, 24.x] steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@29e23b68b9b868d31805d1adce431cb35fd2de83 # v2.0.1 with: is-high-risk-environment: false node-version: ${{ matrix.node-version }} diff --git a/.github/workflows/create-release-pr.yml b/.github/workflows/create-release-pr.yml index f12abc9..2c3cbe1 100644 --- a/.github/workflows/create-release-pr.yml +++ b/.github/workflows/create-release-pr.yml @@ -22,13 +22,13 @@ jobs: pull-requests: write steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@29e23b68b9b868d31805d1adce431cb35fd2de83 # v2.0.1 with: is-high-risk-environment: true fetch-depth: 0 ref: ${{ github.event.inputs.base-branch }} - - uses: MetaMask/action-create-release-pr@v4 + - uses: MetaMask/action-create-release-pr@268f95dd4099efbf661dd8ad7a979e7c8cc61ff9 # v4.0.0 with: release-type: ${{ github.event.inputs.release-type }} release-version: ${{ github.event.inputs.release-version }} diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 445811b..22565dd 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@29e23b68b9b868d31805d1adce431cb35fd2de83 # v2.0.1 with: is-high-risk-environment: false - name: Download actionlint @@ -25,7 +25,7 @@ jobs: analyse-code: name: Analyse code needs: check-workflows - uses: MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@v2 + uses: MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@becb242930b3cc271c26da0280050db9c157e291 # v2.1.1 with: scanner-ref: v2 paths-ignored: | @@ -94,7 +94,7 @@ jobs: IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }} runs-on: ubuntu-latest steps: - - uses: MetaMask/action-is-release@v2 + - uses: MetaMask/action-is-release@3cd51b98fa98d1347d06f5961299b0172ee31ae8 # v2.3.0 id: is-release publish-release: diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 64d25e6..502c4bb 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -18,16 +18,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@29e23b68b9b868d31805d1adce431cb35fd2de83 # v2.0.1 with: is-high-risk-environment: true ref: ${{ github.sha }} - - uses: MetaMask/action-publish-release@v3 + - uses: MetaMask/action-publish-release@f01f1be110d60fb07d86c880ce3d6bdb353524d3 # v3.3.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: yarn build - name: Upload build artifacts - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 with: name: publish-release-artifacts-${{ github.sha }} retention-days: 4 @@ -41,16 +41,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@29e23b68b9b868d31805d1adce431cb35fd2de83 # v2.0.1 with: is-high-risk-environment: true ref: ${{ github.sha }} - name: Restore build artifacts - uses: actions/download-artifact@v6 + uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 with: name: publish-release-artifacts-${{ github.sha }} - name: Dry Run Publish - uses: MetaMask/action-npm-publish@v6 + uses: MetaMask/action-npm-publish@18df42148c35aabb98e00f9fda127d421af141df # v6.5.0 with: dry-run: true slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }} @@ -67,16 +67,16 @@ jobs: id-token: write steps: - name: Checkout and setup environment - uses: MetaMask/action-checkout-and-setup@v2 + uses: MetaMask/action-checkout-and-setup@29e23b68b9b868d31805d1adce431cb35fd2de83 # v2.0.1 with: is-high-risk-environment: true ref: ${{ github.sha }} - name: Restore build artifacts - uses: actions/download-artifact@v6 + uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0 with: name: publish-release-artifacts-${{ github.sha }} - name: Publish - uses: MetaMask/action-npm-publish@v6 + uses: MetaMask/action-npm-publish@18df42148c35aabb98e00f9fda127d421af141df # v6.5.0 with: dry-run: false # This `NPM_TOKEN` is only needed to publish a package for the first