From ac7cbcd9241f1cd65d1bf4cdd61cfa433f70c19f Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 21 Sep 2026 10:24:01 -0400 Subject: [PATCH] Float first-party actions on majors, pin third-party by release SHA Aligns this package's GitHub Actions references with the org convention: float first-party actions on their major tag, pin third-party actions to a commit SHA, and keep both on the latest release. - First-party actions (`actions/*`, `github/*`) move off commit SHAs onto their current major tag. Every SHA replaced resolves to the tip of the major it now floats on, so the resolved commit is unchanged today and security patches arrive on their own from here. Pinning GitHub's own actions inside GitHub's own runner buys nothing and holds back patches. - Third-party actions stay pinned to a commit SHA, because a git tag is mutable and the action's owner can rewrite it. Each pin's comment now names the immutable release (`# 2.37.2`) rather than a mutable major tag (`# v2`) -- a comment naming a moving tag cannot tell you whether the pin is stale. 5 workflow file(s), 20 reference(s). Distinct transitions: - `actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9` -> `actions/cache@v6` - `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1` -> `actions/checkout@v7` - `actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97` -> `actions/setup-python@v7` --- .github/workflows/install.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/security.yml | 4 ++-- .github/workflows/static-analysis.yml | 18 +++++++++--------- .github/workflows/tests.yml | 14 +++++++------- 5 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml index 8db7372..40d0690 100644 --- a/.github/workflows/install.yml +++ b/.github/workflows/install.yml @@ -23,7 +23,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3137299..8d29929 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 05f1b47..1e5ae0b 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 @@ -33,7 +33,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }} diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 740d22e..f44f0b1 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 @@ -31,7 +31,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }} @@ -56,7 +56,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 @@ -69,7 +69,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }} @@ -94,7 +94,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 @@ -107,7 +107,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }} @@ -134,7 +134,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 @@ -148,7 +148,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }} @@ -173,7 +173,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 337d080..f4cdfbc 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -29,7 +29,7 @@ jobs: stability: prefer-lowest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false @@ -46,7 +46,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }} @@ -85,7 +85,7 @@ jobs: python: ['3.11', '3.13'] steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false @@ -102,7 +102,7 @@ jobs: # PATH, which is not the matrix version this job exists to test. - name: Set up Python id: setup-python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python }} @@ -112,7 +112,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }} @@ -143,7 +143,7 @@ jobs: timeout-minutes: 10 steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@v7 with: persist-credentials: false @@ -160,7 +160,7 @@ jobs: run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT" - name: Restore composer cache - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + uses: actions/cache@v6 with: path: ${{ steps.composer-cache.outputs.dir }} key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('**/composer.json') }}