Repository navigation
ci: update github actions - #277
Merged
Merged
Conversation
Pins actions/checkout, actions/setup-node, and webiny/action-conventional-commits to their resolved commit SHAs (with the tag kept as a trailing comment) to harden CI against upstream tag mutation.
…ws refs Bumps the reusable workflow calls to their latest published tags (conventional-commits-v1.2.1, release-please-v2.2.1, publish-npm-v1.7.1) and pins each to its resolved commit SHA, with the tag kept as a trailing comment.
PierreJeanjacquot
force-pushed
the
chore/pin-actions
branch
from
September 21, 2026 12:12
781b977 to
da9986a
Compare
PierreJeanjacquot
marked this pull request as ready for review
September 21, 2026 12:19
…rsions Bump actions/checkout and actions/setup-node from v4.4.0 to v7.0.1 and v7.1.0, and bump the iExecBlockchainComputing/github-actions-workflows conventional-commits, release-please and publish-npm reusable workflows to their latest tags, repinning each to the resolved commit SHA.
Move the invalid top-level description key to a leading comment in four workflow files, and quote $GITHUB_OUTPUT in reusable-compute-staging-version.yml to satisfy shellcheck.
Prevent the git credential used by actions/checkout from persisting in the local git config, so later steps or artifacts in the job cannot leak it.
…e check pull_request_target runs with base-repo permissions and secrets even for PRs from forks, which is unnecessary here since the job only reads the PR title. pull_request is the safe default for that. Also react to new commits pushed to the PR (synchronize), not just title/PR metadata changes.
Set permissions: {} at the workflow level and the minimal permissions each job actually needs (contents: read, plus packages: write and id-token: write for jobs that call publish-npm), instead of relying on the default GITHUB_TOKEN permissions.
…lease
Pass only the two secrets the reusable release-please workflow actually declares (RELEASE_PLEASE_APPLICATION_ID, RELEASE_PLEASE_PRIVATE_KEY) instead of inheriting every repo secret. Also drop the workflow-level permissions block to {}, since the called workflow mints its own scoped GitHub App token and never uses GITHUB_TOKEN.
(inputs.dry-run && '') || inputs.tag always falls through to inputs.tag because an empty string is falsy, so environment got set to the tag even during a dry run. Negate the condition so dry-run correctly yields an empty environment.
Read the branch name and commit SHA from the GITHUB_REF_NAME and GITHUB_SHA environment variables instead of interpolating ${{ github.ref_name }} and ${{ github.sha }} directly into the shell script, where a crafted branch name could otherwise inject arbitrary commands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update actions and workflows
Pin actions and workflows with full commit sha
Remove single commit conventional commit check (conventional commit is covered via PR title check)
Fix zizmor security findings