Skip to content

ci: pin all GitHub Actions to commit SHAs (not tags) - #541

Open
avrabe wants to merge 1 commit into
mainfrom
chore/pin-actions-to-sha
Open

avrabe wants to merge 1 commit into
mainfrom
chore/pin-actions-to-sha

Conversation

@avrabe

@avrabe avrabe commented Nov 1, 2026

Copy link
Copy Markdown
Contributor

Org rule: actions pinned by SHA with the version as a comment (uses: owner/action@<sha> # vN). Rewrites every tag-pinned uses: in .github/workflows. Workflow-only change.

@github-actions

github-actions Bot commented Nov 1, 2026

Copy link
Copy Markdown

LS-N verification gate

✅ 59/59 approved LS entries verified

count
Passed (≥1 test, all green) 59
Failed (≥1 test failure) 0
Missing (no ls_*_NN_* test found) 0

Approved loss-scenarios.yaml entries are expected to have a
regression test named ls_<letter>_<num>_* (e.g. LS-A-11 →
ls_a_11_*). The gate runs each prefix via cargo test --lib --no-fail-fast and aggregates pass/fail/missing.

Failed LS entries

(none)

Missing regression tests

(none)

Updated automatically by tools/post_verification_comment.py.
Source of truth: safety/stpa/loss-scenarios.yaml.

@avrabe
avrabe force-pushed the chore/pin-actions-to-sha branch 2 times, most recently from e2c53a4 to 897945e Compare November 9, 2026 05:52
@avrabe
avrabe force-pushed the chore/pin-actions-to-sha branch from 897945e to 673756a Compare November 9, 2026 09:20
Org rule: actions are referenced by SHA with the version as a comment
(uses: owner/action@<sha> # vN), so a moved tag can never silently change
what CI runs. Rewrites every tag-pinned uses: in .github/workflows.
@avrabe
avrabe force-pushed the chore/pin-actions-to-sha branch from 673756a to 06cb51c Compare November 10, 2026 02:40

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant