From 94ad84dae9813500281e213e6953294870ab3c34 Mon Sep 17 00:00:00 2001 From: Jared Vititoe Date: Tue, 30 Jun 2026 14:53:38 -0400 Subject: [PATCH] CI: pin actions/checkout to a commit SHA semgrep's github-actions-mutable-action-tag rule (now running, after the pip install was fixed) flags actions/checkout@v3 as a mutable tag that could be repointed upstream (supply-chain risk). Pin all four uses to the SHA the v3 tag currently resolves to (v3.6.0), preserving behavior. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/lint.yml | 6 +++--- .gitea/workflows/security.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml index 692a426..1c57ace 100644 --- a/.gitea/workflows/lint.yml +++ b/.gitea/workflows/lint.yml @@ -11,7 +11,7 @@ jobs: name: PHP (phpcs PSR-12) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install PHP and phpcs run: | @@ -27,7 +27,7 @@ jobs: name: JS (eslint) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install ESLint run: npm install --save-dev eslint@8 @@ -39,7 +39,7 @@ jobs: name: PHP requirements (version + extensions) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install PHP with required extensions run: | diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index 71b8542..8b06338 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -13,7 +13,7 @@ jobs: name: PHP Security (semgrep) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install semgrep run: |