Pin edge-apps-actions to v26.9.0 tag - #21
Conversation
Switching from a pinned commit hash to the v26.9.0 version tag is intentional, for easier reference. v26.9.0 points to the exact same commit that was previously pinned by hash, so this is not a reduction in supply-chain safety — it is a readability change, not a move to a floating/unpinned reference.
There was a problem hiding this comment.
🟡 Changes recommended
Pinning third-party Actions to a mutable tag (even if it currently points to the same commit) reduces supply-chain integrity compared to pinning to an immutable commit SHA.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates GitHub Actions workflows to reference the Screenly/edge-apps-actions reusable actions by the v26.9.0 release tag instead of a pinned commit SHA, aiming to improve readability/maintainability in CI/CD workflows that initialize and update the Edge App across stage and production.
Changes:
- Switched
Screenly/edge-apps-actions/updatereferences from a 40-char SHA tov26.9.0in the update workflow (stage + production jobs). - Switched
Screenly/edge-apps-actions/initializereference from a 40-char SHA tov26.9.0in the initialization workflow.
File summaries
| File | Description |
|---|---|
| .github/workflows/update-edge-app.yml | Updates the action reference for Edge App updates (stage/production) from SHA to the v26.9.0 tag. |
| .github/workflows/initialize-edge-app.yml | Updates the action reference for Edge App initialization from SHA to the v26.9.0 tag. |
Review details
Suppressed comments (1)
.github/workflows/update-edge-app.yml:35
- Using a movable release tag for a third-party GitHub Action weakens supply-chain integrity because tags can be retargeted after review. For better security while keeping readability, pin to the reviewed commit SHA and add an inline comment with the tag/version.
- uses: Screenly/edge-apps-actions/update@v26.9.0
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Summary
Screenly/edge-apps-actionsreusable actions are switched from the pinned 40-character commit hash (f4ccd2bd50db5fb0a5147d287ac03cafe552d29b) to thev26.9.0release tag.Why
v26.9.0points to the exact same commit that was previously pinned by hash (see https://github.com/Screenly/edge-apps-actions/releases/tag/v26.9.0), so this does not change which code runs.