From 3959c7f6cc2d0e052b0b14a166b39811ded51b31 Mon Sep 17 00:00:00 2001 From: KiloClaw Security Date: Sun, 28 Jun 2026 03:55:59 +0000 Subject: [PATCH] ci: pin GitHub Actions to full commit SHAs Pin unpinned action references to immutable commit SHAs. Version tags retained as inline comments. See: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions --- .github/workflows/browser-tests.yml | 10 +++++----- .github/workflows/code-check.yml | 24 +++++++++++------------ .github/workflows/issue-stale.yml | 4 ++-- .github/workflows/prerelease-comment.yml | 8 ++++---- .github/workflows/release.yml | 20 +++++++++---------- .github/workflows/signed-commits.yml | 2 +- .github/workflows/templates.yml | 10 +++++----- .github/workflows/test.yml | 18 ++++++++--------- .github/workflows/validate-registries.yml | 8 ++++---- 9 files changed, 52 insertions(+), 52 deletions(-) diff --git a/.github/workflows/browser-tests.yml b/.github/workflows/browser-tests.yml index bf576a10638..30a24ae979f 100644 --- a/.github/workflows/browser-tests.yml +++ b/.github/workflows/browser-tests.yml @@ -12,16 +12,16 @@ jobs: runs-on: ubuntu-latest name: pnpm test:browser steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 with: fetch-depth: 0 - name: Install Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 20 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 name: Install pnpm id: pnpm-install with: @@ -32,7 +32,7 @@ jobs: id: pnpm-cache run: | echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 name: Setup pnpm cache with: path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }} @@ -43,7 +43,7 @@ jobs: run: pnpm install - name: Cache Playwright browsers - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 with: path: ~/.cache/ms-playwright key: ${{ runner.os }}-playwright-${{ hashFiles('**/pnpm-lock.yaml') }} diff --git a/.github/workflows/code-check.yml b/.github/workflows/code-check.yml index 7c502f24779..e2f3dfac7a1 100644 --- a/.github/workflows/code-check.yml +++ b/.github/workflows/code-check.yml @@ -9,16 +9,16 @@ jobs: runs-on: ubuntu-latest name: pnpm lint steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 with: fetch-depth: 0 - name: Install Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 20 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 name: Install pnpm id: pnpm-install with: @@ -29,7 +29,7 @@ jobs: id: pnpm-cache run: | echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 name: Setup pnpm cache with: path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }} @@ -45,16 +45,16 @@ jobs: runs-on: ubuntu-latest name: pnpm format:check steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 with: fetch-depth: 0 - name: Install Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 20 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 name: Install pnpm id: pnpm-install with: @@ -66,7 +66,7 @@ jobs: run: | echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 name: Setup pnpm cache with: path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }} @@ -86,16 +86,16 @@ jobs: runs-on: ubuntu-latest name: pnpm typecheck steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 with: fetch-depth: 0 - name: Install Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 20 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 name: Install pnpm id: pnpm-install with: @@ -106,7 +106,7 @@ jobs: id: pnpm-cache run: | echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 name: Setup pnpm cache with: path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }} diff --git a/.github/workflows/issue-stale.yml b/.github/workflows/issue-stale.yml index 7e6b7dbc6c8..5f0a4b29c2d 100644 --- a/.github/workflows/issue-stale.yml +++ b/.github/workflows/issue-stale.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest if: github.repository_owner == 'shadcn-ui' steps: - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9 id: issue-stale name: "Mark stale issues, close stale issues" with: @@ -27,7 +27,7 @@ jobs: stale-issue-message: "This issue has been automatically marked as stale due to one year of inactivity. It will be closed in 7 days unless there’s further input. If you believe this issue is still relevant, please leave a comment or provide updated details. Thank you. (This is an automated message)" close-issue-message: "This issue has been automatically closed due to one year of inactivity. If you’re still experiencing a similar problem or have additional details to share, please open a new issue following our current issue template. Your updated report helps us investigate and address concerns more efficiently. Thank you for your understanding! (This is an automated message)" operations-per-run: 300 - - uses: actions/stale@v9 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9 id: pr-state name: "Mark stale PRs, close stale PRs" with: diff --git a/.github/workflows/prerelease-comment.yml b/.github/workflows/prerelease-comment.yml index b029d481b02..2547bddec66 100644 --- a/.github/workflows/prerelease-comment.yml +++ b/.github/workflows/prerelease-comment.yml @@ -21,7 +21,7 @@ jobs: - name: Download prerelease info id: download continue-on-error: true - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 with: name: prerelease-info run-id: ${{ github.event.workflow_run.id }} @@ -30,7 +30,7 @@ jobs: - name: Build comment id: info if: steps.download.outcome == 'success' - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: script: | const fs = require("fs"); @@ -67,14 +67,14 @@ jobs: - name: Comment on PR if: steps.info.outputs.body - uses: marocchino/sticky-pull-request-comment@v2 + uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2 with: number: ${{ steps.info.outputs.pr }} message: ${{ steps.info.outputs.body }} - name: Remove the prerelease label once published if: steps.info.outputs.pr - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index de2488d863f..88c12cf7eee 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Select prerelease channel id: prerelease - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: script: | const prereleaseLabels = [ @@ -50,18 +50,18 @@ jobs: core.setOutput("label", selectedLabels[0].name); - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 ref: ${{ github.event.pull_request.head.sha }} - name: Use PNPM - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10.33.4 - name: Use Node.js 20 - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 registry-url: "https://registry.npmjs.org" @@ -112,7 +112,7 @@ jobs: - name: Upload prerelease info if: steps.changesets.outputs.present == 'true' - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: prerelease-info path: prerelease-info.json @@ -128,17 +128,17 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 - name: Use PNPM - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 with: version: 10.33.4 - name: Use Node.js 20 - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 registry-url: "https://registry.npmjs.org" @@ -156,7 +156,7 @@ jobs: run: pnpm build:packages - name: Import GPG key - uses: crazy-max/ghaction-import-gpg@v6 + uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6 with: gpg_private_key: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }} git_user_signingkey: true @@ -165,7 +165,7 @@ jobs: - name: Create Version PR or Publish to NPM id: changesets - uses: changesets/action@v1 + uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1 with: setupGitUser: false commit: "chore(release): version packages" diff --git a/.github/workflows/signed-commits.yml b/.github/workflows/signed-commits.yml index 850da8dbfb3..0f0c259c874 100644 --- a/.github/workflows/signed-commits.yml +++ b/.github/workflows/signed-commits.yml @@ -18,7 +18,7 @@ jobs: name: Signed commits steps: - name: Check PR commits - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/templates.yml b/.github/workflows/templates.yml index f84d8ecab28..e615b5ebaec 100644 --- a/.github/workflows/templates.yml +++ b/.github/workflows/templates.yml @@ -43,17 +43,17 @@ jobs: ROOT_PNPM_VERSION: 10.33.4 TEMPLATE_PNPM_VERSION: ${{ matrix.pnpm-version }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 persist-credentials: false - name: Install Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 22 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 name: Install pnpm id: pnpm-install with: @@ -61,7 +61,7 @@ jobs: run_install: false - name: Install Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 - name: Install Yarn if: matrix.package-manager == 'yarn' @@ -74,7 +74,7 @@ jobs: run: | echo "pnpm_cache_dir=$(pnpm store path)" >> "$GITHUB_OUTPUT" - - uses: actions/cache@v4 + - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 name: Setup pnpm cache with: path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3fc475eb9a3..4cedfdec4df 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -12,16 +12,16 @@ jobs: NEXT_PUBLIC_APP_URL: http://localhost:4000 NEXT_PUBLIC_V0_URL: https://v0.dev steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 with: fetch-depth: 0 - name: Install Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 22 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 name: Install pnpm id: pnpm-install with: @@ -32,7 +32,7 @@ jobs: id: pnpm-cache run: | echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 name: Setup pnpm cache with: path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }} @@ -40,7 +40,7 @@ jobs: restore-keys: | ${{ runner.os }}-pnpm-store- - name: Install Bun - uses: oven-sh/setup-bun@v2 + uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 - name: Install dependencies run: pnpm install @@ -51,16 +51,16 @@ jobs: runs-on: ubuntu-latest name: pnpm test (@shadcn/react) steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 with: fetch-depth: 0 - name: Install Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 22 - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 name: Install pnpm id: pnpm-install with: @@ -71,7 +71,7 @@ jobs: id: pnpm-cache run: | echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 name: Setup pnpm cache with: path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }} diff --git a/.github/workflows/validate-registries.yml b/.github/workflows/validate-registries.yml index d05e3336888..c5c359738cf 100644 --- a/.github/workflows/validate-registries.yml +++ b/.github/workflows/validate-registries.yml @@ -17,12 +17,12 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 0 - name: Install Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3 with: node-version: 20 @@ -59,7 +59,7 @@ jobs: } EOF - - uses: pnpm/action-setup@v4 + - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4 name: Install pnpm id: pnpm-install with: @@ -70,7 +70,7 @@ jobs: id: pnpm-cache run: | echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT - - uses: actions/cache@v3 + - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3 name: Setup pnpm cache with: path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}