feat: pin GitHub Actions to SHA digests and add pin-check workflow#14
Merged
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds an enforcement workflow and example that fail PRs with unpinned GitHub Actions, installs and runs that workflow from ChangesGitHub Actions SHA Pinning Enforcement and Application
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@common.mk`:
- Around line 167-170: The update-action-pins make target incorrectly uses
make-style $(...) which gets expanded by make and yields an empty GITHUB_TOKEN;
in the recipe for the update-action-pins target change the command substitution
to be evaluated by the shell by escaping the $ (use $$(gh auth token) instead of
$(gh auth token)), mirroring the escaping used in the repo-settings target so
GITHUB_TOKEN is set to the actual gh auth token at runtime.
- Around line 152-155: The grep pipeline that assigns to variable unpinned can
return a non-zero exit (causing the job to fail under pipefail) when there are
no matches; update the pipeline used to set the variable named unpinned (the
multi-grep sequence that filters .github/workflows/ and excludes './' and
SHA-pinned uses) to append "|| true" so the command always exits 0 and the
subsequent if [[ -n "$unpinned" ]] check can run reliably.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0d21259f-1120-471d-84cf-bb85aa45d77d
📒 Files selected for processing (6)
.github/workflows/conventional-commits.yml.github/workflows/issues-add-to-project.yml.github/workflows/release-drafter.yaml.github/workflows/update-action-pins.ymlcommon.mkexample/renovate.json
rebEllieous
force-pushed
the
feature/33-pin-gh-actions
branch
from
ed1fabb to
41db43c
Compare
yocaba
reviewed
May 20, 2026
rebEllieous
force-pushed
the
feature/33-pin-gh-actions
branch
from
fd88321 to
ac91b89
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/update-action-pins.yml:
- Line 13: The checkout step currently uses the actions/checkout action but does
not disable credential persistence; update the checkout step (the
actions/checkout@... usage) to include persist-credentials: false so the job
runs read-only and does not persist the GITHUB_TOKEN; ensure the new key is
added directly under the checkout action configuration in the same step.
In `@examples/.github/workflows/update-action-pins.yml`:
- Line 13: Update the GitHub Actions checkout usage to disable credential
persistence and escape the shell interpolation in the guidance string: modify
the actions/checkout@... step (the line containing "uses:
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5") to include a with:
persist-credentials: false entry so the action does not store the token in local
git config, and in the guidance message that currently contains "$(gh auth
token)" escape the dollar sign (e.g., "\$(gh auth token)") so the string is
printed literally instead of being executed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 3950fb72-0d11-460e-8592-fc803524a155
📒 Files selected for processing (7)
.github/workflows/conventional-commits.yml.github/workflows/issues-add-to-project.yml.github/workflows/release-drafter.yaml.github/workflows/update-action-pins.ymlcommon.mkexample/renovate.jsonexamples/.github/workflows/update-action-pins.yml
✅ Files skipped from review due to trivial changes (2)
- .github/workflows/release-drafter.yaml
- example/renovate.json
This was referenced May 21, 2026
rebEllieous
force-pushed
the
feature/33-pin-gh-actions
branch
from
ac91b89 to
86289cd
Compare
yocaba
approved these changes
May 21, 2026
rebEllieous
added a commit
to opendefensecloud/artifact-conduit
that referenced
this pull request
May 21, 2026
) ## What Pin all GitHub Actions workflows to SHA digests and enforce pinning via CI. Closes #33 see opendefensecloud/dev-kit#14 for upstream PR of config <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated GitHub Actions across CI/CD workflows to use pinned commit SHAs instead of floating version tags for improved security and reproducibility * Added automated validation to enforce that all GitHub Actions are pinned to specific commit versions <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/opendefensecloud/artifact-conduit/pull/371?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
](https://app.coderabbit.ai/change-stack/opendefensecloud/artifact-conduit/pull/371?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack){kind=link}
rebEllieous
added a commit
to opendefensecloud/solution-arsenal
that referenced
this pull request
May 21, 2026
) ## What Pin all GitHub Actions workflows to SHA digests and enforce pinning via CI. Closes #33 see opendefensecloud/dev-kit#14 for upstream PR of config
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pin all GitHub Actions workflows to SHA digests and enforce pinning via CI.
Closes #33
Why
Unpinned actions (
@v4,@main) are a supply-chain risk. Pinning to a commit SHA makes workflows reproducible and tamper-evident. Renovate withpinDigests: truekeeps the SHAs current automatically.Testing
update-action-pins .github/workflows/locally to pin all actions- uses: action@tagRENOVATE_TOKEN=... GITHUB_COM_TOKEN=... npx renovate --platform=local --dry-run=fulland confirmedpinDigests: trueproducesupdateType: pinDigestupdates for all workflow filesSummary by CodeRabbit