Repository navigation
Use Commit Hashes to Version Reusable Github Actions Tasks #165
Description
In response to https://www.bleepingcomputer.com/news/security/supply-chain-attack-on-popular-github-action-exposes-ci-cd-secrets/ we should move to pinning GitHub Action versions by commit hash.
Some resources:
- Not natively supported: Support "lock file" equivalent for GitHub actions actions/runner#2195
- Dependabot may support this: For actions that are pinned-by-hash, bump the human readable version number in the code comment dependabot/dependabot-core#4691
- We may be able to run pinact as a one-off and then leverage Dependabot after that.
Metadata
Metadata
Assignees
Type
Projects
- Status
- Status
Activity
[-]GHA version by commit hash[/-][+]Use Commit Hashes to Version Reusable Github Actions Tasks[/+]arbrandes commentedon Feb 19, 2026
@farhan, have you been able to look into this at all, yet?
farhan commentedon Feb 20, 2026
@arbrandes We tried https://github.com/suzuki-shunsuke/pinact, it's working fine
How can we run it in all the repositories, this what we were discussing yesterday
We are on the edge of getting relax from the XBlock extraction work, we have prioritize it as next.
irfanuddinahmad commentedon May 5, 2026
Dependabot alone is not a strict enforcement mechanism for SHA pinning. It is excellent for ongoing updates, but it does not by itself guarantee that repos using tag-based
uses:refs will automatically move to SHA-pinned refs in the next PR.Proposed path forward:
Convert workflow
uses:references from tags to full commit SHA with a human-readable version comment.Example format:
uses: actions/checkout@<40-char-sha> # vX.Y.ZContinue weekly github-actions updates in repos.
After the baseline is SHA-pinned, Dependabot can keep SHA + comment updated over time.
Add a required CI check (for example
pinact run --checkor equivalent policy check) that fails if external actions are not pinned to full SHA. This provides durable protection against future drift back to tags.If available in org settings, enable GitHub Actions policy requiring full-length commit SHA pinning for actions.
15 remaining items
feanil commentedon Jun 1, 2026
@farhan @irfanuddinahmad I've merged everything that doesn't need an update here. Please take a look at the rest of the open PRs and let me know when they're ready for another pass/merging.
irfanuddinahmad commentedon Jun 2, 2026
@feanil @farhan --- Following PRs have been updated with fixes
openedx/edx-django-utils#536
openedx/enmerkar-underscore#246
openedx/edx-val#610
openedx/tutor-contrib-aspects-sample#2
openedx/enterprise-catalog#1134
openedx/frontend-enterprise#499
Following has a pre-existing failure on main:
openedx/edx-cookiecutters#568 — tests (py) job failing but it's a pre-existing failure on main, not caused by this PR. run_ida_tests passes.
Fix on main: openedx/edx-cookiecutters#569
chore: pin GitHub Actions workflows to full commit SHAs
pomegranited commentedon Jun 19, 2026
Hi @irfanuddinahmad Thank you for working on this issue!
Can you help me understand how this changes our review process for the automated dependabot updates? I can see that we're getting SHA commit hashes now instead of version tags, e.g. openedx/completion#438. But do I (as a core committer) need to validate this update differently than I was before?
irfanuddinahmad commentedon Jun 19, 2026
Hi @pomegranited! Great question — the short answer is: the review process is largely the same, but here's what's different to be aware of.
What changed in the workflow YAML
References that used to look like:
now look like:
The human-readable version tag is preserved as a comment, so you can still see at a glance what version is being used.
What Dependabot PRs look like now
Dependabot understands SHA-pinned refs and will continue to open PRs when a new version is available. The PR title/description will still tell you the version change (e.g. "bump codecov/codecov-action from 6.0.1 to 7.0.0"), and the diff will show the old SHA being replaced by the new SHA + updated version comment. You can see an example at openedx/completion#438.
As a core committer, your review doesn't change much:
# vX.Y.Zcomment in the diff confirms the version at a glanceThe main benefit to you is actually more confidence — because the SHA is cryptographically bound to the exact code that will run, a tag re-pointing attack (where a maintainer silently moves a tag to different code) is no longer possible.
chore: pin GitHub Actions to commit SHAs (#188)