From d5a9703ada9f80418614964f4a5254288786a3cd Mon Sep 17 00:00:00 2001 From: mrholek Date: Sat, 18 Jul 2026 02:09:10 +0200 Subject: [PATCH] ci: pin GitHub Actions to full commit SHAs, bump to current versions Pin every action to an immutable 40-char SHA (matching upstream Bootstrap) and bump the stale ones: checkout v7.0.0, setup-node v6.5.0, stale v10.4.0. A mutable tag lets a compromised action run malicious code in CI. Dependabot's github-actions group maintains the pins. --- .github/workflows/build-check.yml | 4 ++-- .github/workflows/project-chartjs-check.yml | 4 ++-- .github/workflows/project-icons-check.yml | 4 ++-- .github/workflows/project-lib-check.yml | 4 ++-- .github/workflows/stale.yml | 2 +- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-check.yml b/.github/workflows/build-check.yml index 224bc007..f6969d72 100644 --- a/.github/workflows/build-check.yml +++ b/.github/workflows/build-check.yml @@ -16,9 +16,9 @@ jobs: os: [ubuntu-latest, windows-latest, macOS-latest] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ matrix.node-version }} cache: 'npm' diff --git a/.github/workflows/project-chartjs-check.yml b/.github/workflows/project-chartjs-check.yml index bd7cdb1d..bb66d81d 100644 --- a/.github/workflows/project-chartjs-check.yml +++ b/.github/workflows/project-chartjs-check.yml @@ -20,9 +20,9 @@ jobs: os: [ubuntu-latest, windows-latest, macOS-latest] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ matrix.node-version }} cache: 'npm' diff --git a/.github/workflows/project-icons-check.yml b/.github/workflows/project-icons-check.yml index aff54278..0c9d23db 100644 --- a/.github/workflows/project-icons-check.yml +++ b/.github/workflows/project-icons-check.yml @@ -20,9 +20,9 @@ jobs: os: [ubuntu-latest, windows-latest, macOS-latest] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ matrix.node-version }} cache: 'npm' diff --git a/.github/workflows/project-lib-check.yml b/.github/workflows/project-lib-check.yml index ccb8d90e..85a1a26a 100644 --- a/.github/workflows/project-lib-check.yml +++ b/.github/workflows/project-lib-check.yml @@ -20,9 +20,9 @@ jobs: os: [ubuntu-latest, windows-latest, macOS-latest] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ matrix.node-version }} cache: 'npm' diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 181393ba..47a3757d 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -18,7 +18,7 @@ jobs: pull-requests: write steps: - - uses: actions/stale@v5 + - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-issue-message: 'This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions'