From 1b3247735be8bf33485992386cc96282de6b7a81 Mon Sep 17 00:00:00 2001 From: rn404 Date: Sun, 5 Jul 2026 20:10:56 +0900 Subject: [PATCH 1/2] ci: pin GitHub Actions to commit SHAs Supply-chain hardening: tag references can be moved to malicious commits; full SHA pins cannot. Version comments kept for readability. rn404/comment-sonar was already SHA-pinned. Co-Authored-By: Claude Fable 5 --- .github/workflows/go_ci.yml | 10 +++++----- .github/workflows/sonar.yml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/go_ci.yml b/.github/workflows/go_ci.yml index 6daad17..58800ec 100644 --- a/.github/workflows/go_ci.yml +++ b/.github/workflows/go_ci.yml @@ -15,8 +15,8 @@ jobs: outputs: matches: ${{ steps.filter.outputs['go'] || 'false' }} steps: - - uses: actions/checkout@v4 - - uses: dorny/paths-filter@v2 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: dorny/paths-filter@7267a8516b6f92bdb098633497bad573efdbf271 # v2.12.0 id: filter with: filters: | @@ -31,8 +31,8 @@ jobs: if: ${{ needs.affected-checks.outputs.matches == 'true' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-go@v5 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod - name: Check formatting @@ -42,7 +42,7 @@ jobs: - name: Test run: go test ./... - name: Lint - uses: golangci/golangci-lint-action@v8 + uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0 with: # Keep in sync with .mise.toml for local reproducibility. version: v2.12.2 diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 55645dc..3082c72 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Run comment-sonar uses: rn404/comment-sonar@a3f7422d64d66e237b1c930946a5fab9e825da9b From 868034b3300280ba099f4cecfad5fa11b377e2ae Mon Sep 17 00:00:00 2001 From: rn404 Date: Sun, 5 Jul 2026 22:25:08 +0900 Subject: [PATCH 2/2] ci: retrigger workflow Co-Authored-By: Claude Fable 5