chore: pin third-party GitHub Actions to SHAs + enable Dependabot - #1816
Conversation
Hardens against supply-chain risk on mutable tags. Dependabot keeps the pinned SHAs fresh weekly, with major bumps held under cooldown. Tracking: DEVPROD-1072
|
📲 You can test the changes from this Pull Request in Simplenote Android by scanning the QR code below to install the corresponding build.
|
The original campaign run used pinact 4.0.0 which silently failed to pin third-party refs in this PR (transient API issue, zero exit code, no diff). This commit adds the missed pins using our own gh-api-backed resolver (see gha-security-audit/pin_resolver.py + test_pin_resolver.py). Tracking: DEVPROD-1072
There was a problem hiding this comment.
Pull request overview
Hardens the repository’s GitHub automation by pinning Gradle GitHub Actions to immutable commit SHAs and extending Dependabot to manage GitHub Actions updates.
Changes:
- Pin
gradle/actions/*workflow steps to a specific commit SHA (keeping the original tag as a comment). - Add a new Dependabot
github-actionsupdate configuration with weekly scheduling and grouping.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/submit-gradle-dependencies.yml |
Pins the Gradle dependency submission action to a commit SHA. |
.github/workflows/gradle-wrapper-validation.yml |
Pins the Gradle wrapper validation action to a commit SHA. |
.github/dependabot.yml |
Adds Dependabot support for GitHub Actions updates with grouping and weekly cadence. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| cooldown: | ||
| default-days: 7 | ||
| semver-major-days: 14 |
There was a problem hiding this comment.
Copilot appears to be confidently incorrect here. 😬
I checked the current GitHub Dependabot docs, and cooldown is a supported v2 option for version updates, including github-actions.
ignore is not equivalent: it suppresses matching updates entirely, while cooldown delays eligible updates and lets them through later. So for “wait 7 days by default / 14 days for majors,” cooldown is the right mechanism.
| - name: Setup Gradle to generate and submit dependency graphs | ||
| uses: gradle/actions/dependency-submission@v4 | ||
| uses: gradle/actions/dependency-submission@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3 |
There was a problem hiding this comment.
This is intentional for this campaign. The PR scope is third-party actions outside github.com/Automattic ownership: actions/* are GitHub-owned actions, and Automattic/dangermattic is an Automattic-owned reusable workflow, so both are deliberately excluded here. The external third-party Gradle actions in this repo are the ones being pinned in this PR.
mokagio
added
the
tooling
mokagio
left a comment
mokagio
left a comment
There was a problem hiding this comment.
Pin third-party GitHub Actions in this repo to commit SHAs (tag preserved as trailing comment).
What's the advantage of SHA over tag?
@mokagio Tags are mutable, so SHA pinning prevents a later tag move from silently changing the code our CI runs. Tags can be used to mount supply chain attacks like - GHSA-69fq-xp46-6x23 |
Two-in-one hardening:
github-actionsecosystem to existing config (weekly, grouped, with cooldown).Tracking: DEVPROD-1072.