xarmian 1052be7282 security(ci): pin all GitHub Actions to commit SHAs (TASK-677) (#201) ...

Every third-party Action in .github/workflows/ was using a floating
tag (@v4, @v5, @v6). A compromised maintainer — or a tag that gets
re-pointed at a malicious commit — could execute attacker code in CI
with contents:write, packages:write, and the GHCR token in scope.
Release.yml is especially exposed: a compromised step there could
publish tampered binaries to GitHub Releases and GHCR.

All 12 'uses:' references now pin to a 40-char commit SHA with a
trailing '# vX.Y.Z' comment (the comment is what humans read during
review; the SHA is what GitHub actually resolves):

  actions/checkout@34e114876b  # v4.3.1
  actions/setup-go@40f1582b24  # v5.6.0
  actions/setup-node@49933ea528 # v4.4.0
  docker/setup-buildx-action@8d2750c68a # v3.12.0
  docker/login-action@c94ce9fb46       # v3.7.0
  goreleaser/goreleaser-action@e435ccd777 # v6.4.0

Version bumps: pin to the newest release within the same major that
was previously in use (so behavior stays the same — no major version
jumps hidden inside a security PR). Dependabot (incoming in TASK-678)
will track the commit-pinned refs and open PRs that update both the
SHA and the version comment together.

Parent: PLAN-644.

2026-04-22 15:27:37 -04:00

..

ci.yml

security(ci): pin all GitHub Actions to commit SHAs (TASK-677) (#201)

2026-04-22 15:27:37 -04:00

release.yml

security(ci): pin all GitHub Actions to commit SHAs (TASK-677) (#201)

2026-04-22 15:27:37 -04:00