Add hashes to GH actions plugins#2324
Open
ktbyers wants to merge 4 commits into
Open
Conversation
Replace floating version tags with full commit SHAs to prevent supply-chain attacks where a tag is silently moved to a malicious commit. The original tag is retained as an inline comment for human readability. actions/checkout: v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 astral-sh/setup-uv: v5 -> d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86
Replace floating tags and branch reference with full commit SHAs. The original tag/branch is retained as an inline comment. actions/checkout: v3 -> f43a0e5ff2bd294095638e18286ca9a3d1956744 actions/setup-python: v4 -> 7f4fc3e22c37d6ff65e88745f38bd3157c663f7c pypa/gh-action-pypi-publish: master -> c1b34028248d0c9f7d90fe29fef2122e2276ff6f Note: pypa/gh-action-pypi-publish was pinned to 'master' (a mutable branch ref) which is the highest risk form -- any push to that branch would have been picked up by the next workflow run.
Switch from the master branch SHA to the v1.14.0 release tag SHA (cef221092ed1bacb1cc03d23a2d87d1d172e277b), released 2026-04-07. A named release tag is preferable to a raw branch SHA as it is meaningful to human reviewers and tied to a specific changelog entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make some improvements with respect to GH actions security.