chore: pin GitHub Actions to commit SHA, remove pr-review workflow by glours · Pull Request #13662 · docker/compose

glours · 2026-03-24T16:31:10Z

What I did

Pin all action references to full commit SHA instead of mutable version tags. Tag retained as inline comment for readability.
Remove pr-review.yml workflow.

Related issue
N/A

(not mandatory) A picture of a cute animal, if possible in relation to what you did

Copilot

Pull request overview

This PR hardens GitHub Actions security and reproducibility by pinning all referenced actions/reusable workflows to immutable commit SHAs, and removes the pr-review workflow.

Changes:

Pin action references in existing workflows to full commit SHAs (with version tags kept as inline comments).
Pin reusable workflow calls (e.g., docker/github-builder, docker/docs) to specific commit SHAs.
Remove the .github/workflows/pr-review.yml workflow.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`.github/workflows/stale.yml`	Pins `actions/stale` to a commit SHA.
`.github/workflows/pr-review.yml`	Removes the PR review automation workflow.
`.github/workflows/merge.yml`	Pins checkout/setup-go and reusable workflow/action invocations to SHAs.
`.github/workflows/docs-upstream.yml`	Pins checkout/upload-artifact and the `docker/docs` reusable workflow to SHAs.
`.github/workflows/ci.yml`	Pins all referenced actions/reusable workflows (checkout, buildx, artifacts, bake, codecov, etc.) to SHAs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-24T16:35:11Z

 - 
 name: Unit Test Summary
- uses: test-summary/action@v2
+ uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 # v2
 with:
 paths: bin/coverage/unit/report.xml 


There is trailing whitespace in this steps list item (the - line) and in the paths: value. Trailing spaces can cause noisy diffs and can break YAML/whitespace linters if enabled later; please remove the extra spaces and keep the list item marker formatting consistent with the rest of the file.

Copilot · 2026-03-24T16:35:12Z

- uses: test-summary/action@v2
+ uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 # v2
 with:
 paths: /tmp/report/report.xml 


The paths: value here has trailing whitespace. Please trim it to avoid noisy diffs and potential YAML/whitespace lint failures.
Suggested change
paths: /tmp/report/report.xml
paths: /tmp/report/report.xml

thaJeztah · 2026-03-24T16:42:06Z

 -
 name: Checkout
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4


Should we take the opportunity to update to current versions? (v6 or v6.0.2)? I think dependabot then also will update them.
(Not sure if the older versions use obsolete Node versions, so may become non-functional)

Done @thaJeztah

thaJeztah

LGTM

- Pin all action references to full commit SHA instead of mutable version tags. Tag retained as inline comment for readability. - Remove pr-review.yml workflow. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Guillaume Lours <glours@users.noreply.github.com> # Conflicts: # .github/workflows/pr-review.yml

- actions/checkout v4 -> v6 - actions/upload-artifact v4/v6 -> v7 - actions/download-artifact v4/v7 -> v8 - docker/setup-buildx-action v3 -> v4 - docker/bake-action v6 -> v7 - actions/stale v9 -> v10 - actions/create-github-app-token v1 -> v3 - actions/github-script v7 -> v8 - ossf/scorecard-action v2.4.0 -> v2.4.3 - ncipollo/release-action v1.10.0 -> v1.21.0 - mxschmitt/action-tmate v3.11 -> v3.23 - codecov/codecov-action, test-summary/action, github/codeql-action: bump to latest patch Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Guillaume Lours <glours@users.noreply.github.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [docker/compose](https://github.com/docker/compose) | patch | `v5.1.1` → `v5.1.2` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>docker/compose (docker/compose)</summary> ### [`v5.1.2`](https://github.com/docker/compose/releases/tag/v5.1.2) [Compare Source](docker/compose@v5.1.1...v5.1.2) #### What's Changed ##### 🐛 Fixes - Fix TTY timer rendering when duration length changes by [@MaybeSam05](https://github.com/MaybeSam05) in [#13634](docker/compose#13634) - Fix up attach filtering by [@false200](https://github.com/false200) in [#13664](docker/compose#13664) - Preserve ssh:// URL scheme when resolving Dockerfile path by [@ssam18](https://github.com/ssam18) in [#13669](docker/compose#13669) - Initialize and pass envFiles map in processExtends by [@Mohamed-Moumni](https://github.com/Mohamed-Moumni) in [#13678](docker/compose#13678) - Fix TestRunHook\_ConsoleSize on macOS by [@thaJeztah](https://github.com/thaJeztah) in [#13686](docker/compose#13686) - Restore post-connect fallback for multi-network stacks on API < 1.44 by [@jotka](https://github.com/jotka) in [#13629](docker/compose#13629) - Publish: return api.ErrCanceled when user declines interactive prompts by [@ishwar170695](https://github.com/ishwar170695) in [#13674](docker/compose#13674) - Return error on non-ErrNotExist stat failures in Tar.Sync() by [@Lidang-Jiang](https://github.com/Lidang-Jiang) in [#13684](docker/compose#13684) ##### 🔧 Internal - Refactor: thread context through publish sensitive data check by [@ishwar170695](https://github.com/ishwar170695) in [#13653](docker/compose#13653) - Add AI-powered MR review workflow via `docker/cagent-action` by [@glours](https://github.com/glours) in [#13659](docker/compose#13659) - Update `cagent-action` to latest (with better permissions) by [@derekmisler](https://github.com/derekmisler) in [#13665](docker/compose#13665) - Pin GitHub Actions to commit SHA, remove pr-review workflow by [@glours](https://github.com/glours) in [#13662](docker/compose#13662) - Exclude hook\_test.go from Windows builds and propagate ExecStart error in runWaitExec by [@pawannn](https://github.com/pawannn) in [#13683](docker/compose#13683) - Skip MR review workflow for Dependabot MRs by [@glours](https://github.com/glours) in [#13679](docker/compose#13679) - Use negotiated API version for network setup by [@glours](https://github.com/glours) in [#13690](docker/compose#13690) - Fix mixed assertion libraries in tests by [@thaJeztah](https://github.com/thaJeztah) in [#13689](docker/compose#13689) - Test: use random host port for dind TLS build test by [@ricardobranco777](https://github.com/ricardobranco777) in [#13630](docker/compose#13630) - Remove direct dependency on `docker/docker` by [@glours](https://github.com/glours) in [#13706](docker/compose#13706) ##### ⚙️ Dependencies - Bump github.com/containerd/platforms from `1.0.0-rc.2` to `1.0.0-rc.3` by [@dependabot](https://github.com/dependabot)\[bot] in [#13657](docker/compose#13657) - Bump golangci-lint to `v2.11.3` and configure CLAUDE to use it on change by [@ndeloof](https://github.com/ndeloof) in [#13656](docker/compose#13656) - Bump google.golang.org/grpc from `1.78.0` to `1.79.3` by [@dependabot](https://github.com/dependabot)\[bot] in [#13642](docker/compose#13642) - Bump github.com/moby/patternmatcher from `0.6.0` to `0.6.1` by [@dependabot](https://github.com/dependabot)\[bot] in [#13667](docker/compose#13667) - Bump go.opentelemetry.io/otel/sdk from `1.39.0` to `1.42.0` by [@glours](https://github.com/glours) in [#13663](docker/compose#13663) - Bump github.com/docker/cli from `29.2.1+incompatible` to `29.3.1+incompatible` by [@dependabot](https://github.com/dependabot)\[bot] in [#13670](docker/compose#13670) - Bump github.com/hashicorp/go-version from `1.8.0` to `1.9.0` by [@dependabot](https://github.com/dependabot)\[bot] in [#13692](docker/compose#13692) - Bump github.com/docker/buildx `v0.33.0`, buildkit `v0.29.0` by [@thaJeztah](https://github.com/thaJeztah) in [#13693](docker/compose#13693) - Bump google.golang.org/grpc from `1.79.3` to `1.80.0` by [@dependabot](https://github.com/dependabot)\[bot] in [#13697](docker/compose#13697) - Bump github.com/containerd/platforms from `1.0.0-rc.3` to `1.0.0-rc.4` by [@dependabot](https://github.com/dependabot)\[bot] in [#13696](docker/compose#13696) - Bump github.com/moby/moby/client `v0.4.0`, moby/api `v1.54.1` by [@thaJeztah](https://github.com/thaJeztah) in [#13708](docker/compose#13708) - Bump github.com/docker/cli `v29.4.0` by [@thaJeztah](https://github.com/thaJeztah) in [#13707](docker/compose#13707) - Bump compose-go to version `v2.10.2` by [@glours](https://github.com/glours) in [#13705](docker/compose#13705) - Bump to Go `1.25.9` by [@thaJeztah](https://github.com/thaJeztah) in [#13720](docker/compose#13720) #### New Contributors - [@MaybeSam05](https://github.com/MaybeSam05) made their first contribution in [#13634](docker/compose#13634) - [@ishwar170695](https://github.com/ishwar170695) made their first contribution in [#13653](docker/compose#13653) - [@derekmisler](https://github.com/derekmisler) made their first contribution in [#13665](docker/compose#13665) - [@false200](https://github.com/false200) made their first contribution in [#13664](docker/compose#13664) - [@ssam18](https://github.com/ssam18) made their first contribution in [#13669](docker/compose#13669) - [@Mohamed-Moumni](https://github.com/Mohamed-Moumni) made their first contribution in [#13678](docker/compose#13678) - [@pawannn](https://github.com/pawannn) made their first contribution in [#13683](docker/compose#13683) - [@jotka](https://github.com/jotka) made their first contribution in [#13629](docker/compose#13629) - [@Lidang-Jiang](https://github.com/Lidang-Jiang) made their first contribution in [#13684](docker/compose#13684) **Full Changelog**: <docker/compose@v5.1.1...v5.1.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever MR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

glours requested a review from a team as a code owner March 24, 2026 16:31

glours requested review from Copilot and ndeloof March 24, 2026 16:31

Copilotstarted reviewing on behalf of glours March 24, 2026 16:31 View session

glours force-pushed the hardening-gha-workflows branch from 4c2968c to 0d5cc3aCompare March 24, 2026 16:32

CopilotAI reviewed Mar 24, 2026
View reviewed changes

thaJeztah reviewed Mar 24, 2026
View reviewed changes

glours enabled auto-merge (rebase) March 24, 2026 17:16

thaJeztah approved these changes Mar 24, 2026
View reviewed changes

glours disabled auto-merge March 25, 2026 08:51

gloursand others added 2 commits March 25, 2026 09:54

glours force-pushed the hardening-gha-workflows branch from ea34fd0 to 0afdd48Compare March 25, 2026 08:55

glours enabled auto-merge (rebase) March 25, 2026 08:55

ndeloof approved these changes Mar 25, 2026
View reviewed changes

glours merged commit 0de456b into mainMar 25, 2026
79 of 82 checks passed

glours deleted the hardening-gha-workflows branch March 25, 2026 09:19

BrewTestBot mentioned this pull request Apr 9, 2026
docker-compose 5.1.2 Homebrew/homebrew-core#276795
Merged

rancherbot mentioned this pull request Apr 10, 2026
rddepman: bump dockerCompose from 5.1.1 to 5.1.2 rancher-sandbox/rancher-desktop#10124
Merged

thaJeztah mentioned this pull request Jun 9, 2026
gha: update docs-upstream to pin workflows by sha #13834
Merged

Navigation Menu

Uh oh!

chore: pin GitHub Actions to commit SHA, remove pr-review workflow - #13662

chore: pin GitHub Actions to commit SHA, remove pr-review workflow#13662
glours merged 2 commits into
mainfrom
hardening-gha-workflows

glours commented Mar 24, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

CopilotAIMar 24, 2026

Uh oh!

CopilotAIMar 24, 2026

Uh oh!

thaJeztahMar 24, 2026

Uh oh!

gloursMar 24, 2026

Uh oh!

thaJeztah left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

glours commented Mar 24, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

CopilotAIMar 24, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAIMar 24, 2026

Choose a reason for hiding this comment

Uh oh!

thaJeztahMar 24, 2026

Choose a reason for hiding this comment

Uh oh!

gloursMar 24, 2026

Choose a reason for hiding this comment

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants