Uh oh!
There was an error while loading. Please reload this page.
sec(ci): pin actions/* refs to commit SHAs (backend#1491, D10) - #160
Merged
Conversation
Pin every actions/* ref to the full 40-char commit SHA it currently resolves to, with a trailing exact-version comment (D10, RFC-BACKEND-1405). Behaviour-preserving: no version changes, only removal of silent tag mutation. tracebloc/* refs stay on @main by design; third-party refs were pinned under backend#1490. Part of tracebloc/backend#1491. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
LukasWodka
commented
Aug 6, 2026
ContributorAuthor
FR on staging → Ready for prod (staging FR sweep, 2026-08-06). Basis: CI/tooling-only change with no product runtime surface — verified green through code review + Bugbot on develop and the fr-gated staging promotion. No product-behavior verification required for this class. |
LukasWodka added a commit
that referenced
this pull request
Aug 6, 2026
First push of this branch produced a startup_failure on the reusable call (run 31086491251): every other check reported normally and `Code quality` never started. Cause: `action-pins` and `action-pins-soft-fail` were added in #159, which is on `develop`; `main` still carries the five-job version of code-quality.yml. Callers must reference @main (Q3), and passing an input the @main callee does not declare fails the entire call before any job runs. Same merge-order trap as the #160 audit red: a change becomes consumable by @main callers when it is PROMOTED, not when it is merged. The other five jobs still run armed, so most of backend#1603 closes now. The arming diff is written verbatim in the file so the follow-up is mechanical once #159 reaches main. Refs backend#1603.
LukasWodka added a commit
that referenced
this pull request
Aug 6, 2026
…1603) (#171) * feat(ci): run the org's own code-quality suite on this repo (backend#1603) This repo publishes code-quality.yml -- and its action-pins job -- to all 19 other repos, and was the only repo that never ran it. The exemption was invisible because actionlint.yml looks like coverage: it type-checks every expression, validates needs/uses wiring, and shellchecks every run: block. What it does not do is look at action REFS. So the pinning rule this repo defines was the one rule this repo was not subject to. That is not theoretical. On 2026-08-06 .github#168 -- an otherwise correct fix -- reverted actions/checkout from its pinned commit SHA back to the mutable @v4 tag, in advance-deploy-env.yml, the most-consumed reusable workflow in the org and one that runs with PROJECTS_KANBAN_TOKEN in scope. action-pins exists to fail exactly that diff. It did not run. A human reading the diff caught it, which is the review path D10 was written to stop depending on. Armed from day one rather than soft-failed into a backlog, because the tree was measured first: shellcheck --severity=error clean over both shell scripts, house-rules.sh clean over the same, and 24 `uses:` refs across 23 workflows with zero pin violations. ruff and gitleaks could not be run locally and get their first honest look on this PR; whatever they surface is fixed or baselined here rather than the gate being softened -- the same bargain e2e-test-agent's caller records in its own comment. action-pins-soft-fail is set to false explicitly rather than left to inherit soft-fail. It is the check whose absence let #168 through, and every other repo consumes these workflows at @main and inherits whatever refs they pin, so this repo has a specific duty to enforce it on itself. actionlint.yml stays separate. The two gates have deliberately different postures -- actionlint blocks from day one against a tree cleaned in the same change; code-quality ships soft-fail: true for repos still clearing backlog -- and folding them together would force one posture onto both. No paths: filter, so the check can be made required without leaving workflow-free PRs waiting on a status that never reports. Refs backend#1603, backend#1491 (D10), backend#1276. * fix(ci): drop the action-pins inputs -- @main does not declare them yet First push of this branch produced a startup_failure on the reusable call (run 31086491251): every other check reported normally and `Code quality` never started. Cause: `action-pins` and `action-pins-soft-fail` were added in #159, which is on `develop`; `main` still carries the five-job version of code-quality.yml. Callers must reference @main (Q3), and passing an input the @main callee does not declare fails the entire call before any job runs. Same merge-order trap as the #160 audit red: a change becomes consumable by @main callers when it is PROMOTED, not when it is merged. The other five jobs still run armed, so most of backend#1603 closes now. The arming diff is written verbatim in the file so the follow-up is mechanical once #159 reaches main. Refs backend#1603.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin every
actions/*ref in this repo's workflows to the full 40-char commit SHA it currently resolves to, with a trailing exact-version comment — same form and rules as the third-party run under backend#1490 (D10, RFC-BACKEND-1405). Behaviour-preserving: no version changes, only removal of silent tag mutation.tracebloc/*refs stay on@mainby design; third-party refs were already pinned under backend#1490.actions/add-to-project@v1.0.2244f685bbc3b7adfa8466e08b698b5577571133e# v1.0.2actions/checkout@v411d5960a326750d5838078e36cf38b85af677262# v4.4.0actions/setup-python@v5a26af69be951a213d495a4c3e4e4022e16d87065# v5.6.0actions/stale@v95bef64f19d7facfb25b37b414482c7164d639639# v9.1.08 call sites pinned across 5 workflow files. Verified: actionlint clean (no new findings vs the base branch), YAML parses, no mutable
actions/*refs remain in.github/workflows/.Part of tracebloc/backend#1491.
🤖 Generated with Claude Code
Note
Low Risk
Mechanical ref pinning with no logic or version changes; only reduces risk of unexpected action updates.
Overview
Pins 8
actions/*workflow steps across 5 files from mutable version tags to immutable 40-character commit SHAs, each with a trailing# vX.Y.Zcomment (RFC D10 / backend#1490 pattern). No version bumps—only supply-chain hardening against silent tag retargeting.actions/checkout:@v4→11d5960…(# v4.4.0) inadvance-deploy-env.yml,caller-drift.yml(×2), andfr-gate.yml.actions/setup-python:@v5→a26af69…(# v5.6.0) incaller-drift.yml(×2).actions/add-to-project:@v1.0.2→ pinned SHA inadd-to-kanban.yml.actions/stale:@v9→ pinned SHA (# v9.1.0) instale-backlog.yml.tracebloc/*callers stay on@main; third-party pins were already done elsewhere per the PR description.Reviewed by Cursor Bugbot for commit 7359791. Bugbot is set up for automated code reviews on this repo. Configure here.