From 80fa98744244604b32cacc872a7f7ddfd269e45a Mon Sep 17 00:00:00 2001 From: Riccardo Sarro Date: Mon, 22 Jun 2026 12:04:41 +0200 Subject: [PATCH 1/3] fix: pin GitHub Actions to SHA for supply chain security Co-authored-by: Cursor Agent --- .github/workflows/shipit.yml | 10 +++++----- .github/workflows/test.yml | 10 +++++----- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/shipit.yml b/.github/workflows/shipit.yml index 1cc44776..2db305e0 100644 --- a/.github/workflows/shipit.yml +++ b/.github/workflows/shipit.yml @@ -10,9 +10,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2.3.4 + - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4 - name: Cache - uses: actions/cache@v2.1.6 + uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353 # v2.1.6 with: path: | "$HOME/.gradle/caches/" @@ -20,12 +20,12 @@ jobs: "$HOME/.android/build-cache" key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*') }} - name: set up JDK 11 - uses: actions/setup-java@v2.2.0 + uses: actions/setup-java@4b1b3d4a82f726de9ba1945f8c6967b67caf5dcd # v2.2.0 with: distribution: 'adopt' java-version: '11' - name: Install Ruby - uses: ruby/setup-ruby@v1.81.0 + uses: ruby/setup-ruby@57d46d78b7d959dc4a248024a29bb17d4e357e5c # v1.81.0 with: ruby-version: 2.6.3 bundler-cache: true @@ -36,7 +36,7 @@ jobs: rm -f $HOME/.gradle/caches/modules-2/modules-2.lock rm -fr $HOME/.gradle/caches/*/plugin-resolution/ - name: Notify Slack - uses: 8398a7/action-slack@v3 + uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3 with: status: ${{ job.status }} fields: repo,action,ref,job,took diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 70bcfa7c..b831906d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -10,9 +10,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2.3.4 + - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4 - name: Cache - uses: actions/cache@v2.1.6 + uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353 # v2.1.6 with: path: | "$HOME/.gradle/caches/" @@ -20,12 +20,12 @@ jobs: "$HOME/.android/build-cache" key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*') }} - name: set up JDK 11 - uses: actions/setup-java@v2.2.0 + uses: actions/setup-java@4b1b3d4a82f726de9ba1945f8c6967b67caf5dcd # v2.2.0 with: distribution: 'adopt' java-version: '11' - name: Install Ruby - uses: ruby/setup-ruby@v1.81.0 + uses: ruby/setup-ruby@57d46d78b7d959dc4a248024a29bb17d4e357e5c # v1.81.0 with: ruby-version: 2.6.3 bundler-cache: true @@ -36,7 +36,7 @@ jobs: rm -f $HOME/.gradle/caches/modules-2/modules-2.lock rm -fr $HOME/.gradle/caches/*/plugin-resolution/ - name: Notify Slack - uses: 8398a7/action-slack@v3 + uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3 with: status: ${{ job.status }} fields: repo,action,ref,job,took From 8eb0f6b34a64b9e6a250cbd0d2d9bd48ce5d11d8 Mon Sep 17 00:00:00 2001 From: security-claw Date: Tue, 23 Jun 2026 09:31:36 +0000 Subject: [PATCH 2/3] fix: bump actions/cache from deprecated v2.1.6 to v4.3.0 GitHub retired actions/cache v1/v2 on Feb 1, 2025; runs requesting those versions auto-fail at the 'Getting action download info' step regardless of SHA pinning. v4 is input-compatible with v2 so no workflow changes beyond the version bump are needed. Ref: https://github.blog/changelog/2024-12-05-notice-of-upcoming-releases-and-breaking-changes-for-github-actions/#actions-cache-v1-v2-and-actions-toolkit-cache-package-closing-down --- .github/workflows/shipit.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shipit.yml b/.github/workflows/shipit.yml index 2db305e0..01ecd194 100644 --- a/.github/workflows/shipit.yml +++ b/.github/workflows/shipit.yml @@ -12,7 +12,7 @@ jobs: steps: - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4 - name: Cache - uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353 # v2.1.6 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | "$HOME/.gradle/caches/" From 0d1529fcd450d1b68a02a082ce3fa14e972db521 Mon Sep 17 00:00:00 2001 From: security-claw Date: Tue, 23 Jun 2026 09:31:37 +0000 Subject: [PATCH 3/3] fix: bump actions/cache from deprecated v2.1.6 to v4.3.0 (test.yml) --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b831906d..17fa0b75 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -12,7 +12,7 @@ jobs: steps: - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4 - name: Cache - uses: actions/cache@c64c572235d810460d0d6876e9c705ad5002b353 # v2.1.6 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | "$HOME/.gradle/caches/"