From 4b253888f6fbb34874204f872d1a3577f72547bd Mon Sep 17 00:00:00 2001 From: Andrei Hasna Date: Mon, 3 Aug 2026 22:51:57 +0300 Subject: [PATCH] ci: pin ci.yml third-party actions to commit shas All five action references in ci.yml used mutable major tags, so an upstream tag retarget lands arbitrary code in CI -- including in the `Verify generated artifacts` step, whose byte-for-byte comparison is the gate protecting the committed bin/ and dist/ bundles. Pinned at the tag each step already referenced -- this freezes, it does not upgrade: actions/checkout v4 -> 11d5960 (v4.4.0) x2 oven-sh/setup-bun v2 -> 0c5077e (v2.2.0) x2 actions/setup-node v4 -> 49933ea (v4.4.0) The `bun-version: 1.3.14` inputs are untouched. Pinning the action's own sha does not change which bun it installs, so the generated-artifact comparison behaves exactly as before. setup-bun v2 currently resolves to 0c5077e, the same sha already pinned in this org's release workflows. Agent: Silvanus --- .github/workflows/ci.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 09c4e14..ed50412 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,10 +14,10 @@ jobs: runtime: [bun, node] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Setup Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: # LOAD-BEARING for `Verify generated artifacts`, not just a test-runtime choice. # That step rebuilds bin/ and dist/ and compares the result BYTE-FOR-BYTE against @@ -34,7 +34,7 @@ jobs: - name: Setup Node if: matrix.runtime == 'node' - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: latest @@ -54,8 +54,8 @@ jobs: runtime: [bun] runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v4 - - uses: oven-sh/setup-bun@v2 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 with: # Must match the `test` job above — see the note there on why this version is # load-bearing for the generated-artifact byte comparison.