Skip to content

feat(gha): Enforce commit-ish references in the GitHub Actions #1294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
peacock0803sz merged 2 commits into from
Nov 24, 2025
Merged

feat(gha): Enforce commit-ish references in the GitHub Actions #1294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4336192
chore(gha): Use commit-ish versions for more secure actions with pinact
peacock0803sz Nov 20, 2025
042d92b
feat(gha): Enable pinact checking for PRs to GitHub Actions
peacock0803sz Nov 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/auto-merge-dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
if: github.actor == 'dependabot[bot]'
steps:
- id: metadata
uses: dependabot/fetch-metadata@v2
uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/check-and-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout your repository using git
uses: actions/checkout@v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- name: Setup pnpm
uses: pnpm/action-setup@v4.2.0
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
- name: Install dependencies
run: pnpm i --frozen-lockfile
- name: Run ESLint
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/check-article.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,11 @@ jobs:
permissions:
issues: 'write'
steps:
- uses: 'actions/checkout@v5'
- uses: 'actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd' # v5.0.1
with:
ref: 'main'
- name: 'Report'
uses: 'actions/github-script@v8'
uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # v8.0.0
env:
DATE: '${{ inputs.date }}'
with:
Expand Down
21 changes: 21 additions & 0 deletions .github/workflows/check-pinact.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
on:
pull_request:
paths:
- ".github/**/*.yml"
- ".github/**/*.yaml"

permissions:
pull-requests: write
Copy link
Member

@kuuote kuuote Nov 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nits: 書き込めないならこれいらなさそう？

Copy link
Contributor Author

@peacock0803sz peacock0803sz Nov 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

これはPRにコメントするための権限ですね。なので必要

Copy link
Member

@kuuote kuuote Nov 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

なるほど。適当言いましたすまぬ


jobs:
pinact:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
with:
persist-credentials: false

- name: Check GitHub Actions with pinact
uses: suzuki-shunsuke/pinact-action@49cbd6acd0dbab6a6be2585d1dbdaa43b4410133 # v1.0.0
with:
skip_push: "true"
6 changes: 3 additions & 3 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout your repository using git
uses: actions/checkout@v5
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
- name: Install, build, and upload your site
uses: withastro/action@v5
uses: withastro/action@9811f9299d5d37ca0416ca85cee333c7c9485cd1 # v5.0.1
env:
TZ: 'Asia/Tokyo'

Expand All @@ -32,4 +32,4 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
2 changes: 1 addition & 1 deletion .github/workflows/retry-update-article.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
permissions:
actions: 'write'
steps:
- uses: 'actions/github-script@v8'
- uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # v8.0.0
with:
script: |
github.rest.actions.reRunWorkflowFailedJobs({
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/update-article.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,11 @@ jobs:
permissions:
issues: 'write'
steps:
- uses: 'actions/checkout@v5'
- uses: 'actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd' # v5.0.1
with:
ref: 'main'
ssh-key: '${{ secrets.ARTICLE_DEPLOY_KEY }}'
- uses: 'denoland/setup-deno@v2'
- uses: 'denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb' # v2.0.3
with:
deno-version: 'v2.0.0'
- name: 'Run script'
Expand Down Expand Up @@ -52,7 +52,7 @@ jobs:
echo "COMMIT_HASH=$(git rev-parse HEAD)" >> "${GITHUB_OUTPUT}"
git push
- name: 'Report'
uses: 'actions/github-script@v8'
uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # v8.0.0
env:
SCRIPT_RESULT: '${{ steps.script.outputs.RESULT }}'
COMMIT_HASH: '${{ steps.push.outputs.COMMIT_HASH }}'
Expand Down Expand Up @@ -102,7 +102,7 @@ jobs:
permissions:
actions: 'write'
steps:
- uses: 'actions/github-script@v8'
- uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # v8.0.0
with:
script: |
github.rest.actions.createWorkflowDispatch({
Expand Down