From c2aa27d8a254ee149e23a9391bea5a8c16a606a6 Mon Sep 17 00:00:00 2001 From: Brian G Date: Tue, 22 Sep 2026 14:50:59 +0100 Subject: [PATCH] chore: pin GitHub Actions to commit SHAs Pin every `uses:` ref in .github/workflows and composite actions to a full 40-character commit SHA, with the original tag preserved as a comment, e.g. uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 Tags and branches are mutable; commit SHAs are not. Pinning to a SHA closes a supply-chain vector where a compromised action could replace what runs in CI without changing the tag we reference. Generated mechanically with `pinact run` (https://github.com/suzuki-shunsuke/pinact). No version bumps were applied (strict pin). --- .github/workflows/build-lint-test.yml | 18 ++++++++--------- .github/workflows/create-release-pr.yml | 6 +++--- .github/workflows/main.yml | 4 ++-- .github/workflows/publish-gh-pages.yml | 2 +- .github/workflows/publish-release.yml | 22 ++++++++++----------- .github/workflows/security-code-scanner.yml | 2 +- 6 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/build-lint-test.yml b/.github/workflows/build-lint-test.yml index a138dad..9e1e08a 100644 --- a/.github/workflows/build-lint-test.yml +++ b/.github/workflows/build-lint-test.yml @@ -8,9 +8,9 @@ jobs: name: Prepare runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Use Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version-file: '.nvmrc' cache: 'yarn' @@ -26,9 +26,9 @@ jobs: matrix: node-version: [16.x, 18.x, 20.x] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: ${{ matrix.node-version }} cache: 'yarn' @@ -51,9 +51,9 @@ jobs: matrix: node-version: [16.x, 18.x, 20.x] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: ${{ matrix.node-version }} cache: 'yarn' @@ -83,10 +83,10 @@ jobs: matrix: node-version: [16.x, 18.x, 20.x] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: ${{ matrix.node-version }} cache: 'yarn' @@ -102,7 +102,7 @@ jobs: - name: Run Playwright tests run: yarn test - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 if: always() with: name: playwright-report-node-${{ matrix.node-version }} diff --git a/.github/workflows/create-release-pr.yml b/.github/workflows/create-release-pr.yml index 3c99fe8..a4cf4b3 100644 --- a/.github/workflows/create-release-pr.yml +++ b/.github/workflows/create-release-pr.yml @@ -21,7 +21,7 @@ jobs: contents: write pull-requests: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: # This is to guarantee that the most recent tag is fetched. # This can be configured to a more reasonable value by consumers. @@ -30,10 +30,10 @@ jobs: # branch for all git operations and the release PR. ref: ${{ github.event.inputs.base-branch }} - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version-file: '.nvmrc' - - uses: MetaMask/action-create-release-pr@v3 + - uses: MetaMask/action-create-release-pr@c72286592865d9ba0480adc6069c5f0e624f381b # v3.0.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 16aeb06..5d123e2 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -10,7 +10,7 @@ jobs: name: Check workflows runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 - name: Download actionlint id: download-actionlint run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/7fdc9630cc360ea1a469eed64ac6d78caeda1234/scripts/download-actionlint.bash) 1.6.22 @@ -61,7 +61,7 @@ jobs: IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }} runs-on: ubuntu-latest steps: - - uses: MetaMask/action-is-release@v1 + - uses: MetaMask/action-is-release@ae1ebc864afddef847279b999952c7b8fbe21005 # v1.1.0 id: is-release publish-release: diff --git a/.github/workflows/publish-gh-pages.yml b/.github/workflows/publish-gh-pages.yml index 80f4442..3ea5237 100644 --- a/.github/workflows/publish-gh-pages.yml +++ b/.github/workflows/publish-gh-pages.yml @@ -20,7 +20,7 @@ jobs: if: ${{ inputs.destination_dir == '' }} run: exit 1 - name: Setup the repository - uses: metamask/action-checkout-and-setup@v1 + uses: metamask/action-checkout-and-setup@392abd40aa6a0600a3c0ef4af75851662587e6ec # v1.4.0 with: is-high-risk-environment: true - name: Run build script diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index efb3773..0a2d10e 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -14,21 +14,21 @@ jobs: contents: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: ref: ${{ github.sha }} - name: Setup Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version-file: '.nvmrc' - - uses: MetaMask/action-publish-release@v2 + - uses: MetaMask/action-publish-release@bbaa451e72d44f6e2eb18993502da0eaeed1c69d # v2.1.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Install run: | yarn install yarn build - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 id: restore-build with: path: | @@ -40,10 +40,10 @@ jobs: runs-on: ubuntu-latest needs: publish-release steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: ref: ${{ github.sha }} - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 id: restore-build with: path: | @@ -52,7 +52,7 @@ jobs: key: ${{ github.sha }} - name: Dry Run Publish # omit npm-token token to perform dry run publish - uses: MetaMask/action-npm-publish@v2 + uses: MetaMask/action-npm-publish@9449c49fbcb8b5c487dbbc3f6e6171b75a0c6286 # v2.1.1 env: SKIP_PREPACK: true @@ -61,10 +61,10 @@ jobs: runs-on: ubuntu-latest needs: publish-npm-dry-run steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: ref: ${{ github.sha }} - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 id: restore-build with: path: | @@ -72,7 +72,7 @@ jobs: ./node_modules/.yarn-state.yml key: ${{ github.sha }} - name: Publish - uses: MetaMask/action-npm-publish@v2 + uses: MetaMask/action-npm-publish@9449c49fbcb8b5c487dbbc3f6e6171b75a0c6286 # v2.1.1 with: # This `NPM_TOKEN` needs to be manually set per-repository. # Look in the repository settings under "Environments", and set this token in the `npm-publish` environment. @@ -86,7 +86,7 @@ jobs: outputs: RELEASE_VERSION: ${{ steps.get-release-version.outputs.RELEASE_VERSION }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0 with: ref: ${{ github.sha }} - id: get-release-version diff --git a/.github/workflows/security-code-scanner.yml b/.github/workflows/security-code-scanner.yml index 9a32836..3c1cfb3 100644 --- a/.github/workflows/security-code-scanner.yml +++ b/.github/workflows/security-code-scanner.yml @@ -18,7 +18,7 @@ jobs: security-events: write steps: - name: MetaMask Security Code Scanner - uses: MetaMask/action-security-code-scanner@v1 + uses: MetaMask/action-security-code-scanner@234d72bd10c689bdf09a58bcc96b367fb00f9ee8 # v1.1.0 with: repo: ${{ github.repository }} paths_ignored: |